Trust Center

Mekari infrastructure is hosted on Alibaba Cloud (AliCloud) with servers located in Jakarta, Indonesia (ap-southeast-5). Alibaba Cloud’s Indonesia data center comprises three availability zones located in the territory of Indonesia (ap-southeast-5a, ap-southeast-5b, and ap-southeast-5c). Customer data is hosted and stored in data centers located in Indonesia in accordance with ISO 27001 security standards and applicable local regulations (UU PDP). Data is not transferred to other jurisdictions or regions outside of Indonesia without customer consent.

Production workloads are deployed across multiple Availability Zones within Alibaba Cloud’s Indonesia data center to ensure high availability, fault tolerance, and business continuity. This architecture provides redundancy and enables automatic failover in the event of zone-level disruptions, maintaining service resilience with minimal downtime.

Multi-tier network architecture with Virtual Private Cloud (VPC) isolation separating components into segmented subnets (public and private). All ingress traffic is filtered through Web Application Firewall (WAF) for OWASP Top 10 protection and load balancers, while application servers and databases reside in isolated private subnets accessible only through specific ports and security groups. Administrative access requires encrypted VPN connections (AES-256), and the infrastructure is protected by DDoS mitigation services against volumetric attacks.

All Mekari servers are hardened following industry security standards (CIS Benchmark) with encryption enabled for servers and databases at rest. Unnecessary services, ports, and protocols are disabled by default, with access controlled through Security Groups that restrict traffic to authorized protocols only. Administrative access is enforced through encrypted VPN connections to minimize attack surface and prevent unauthorized access.

Continuous automated vulnerability scanning is conducted on all infrastructure, applications, databases, and source code to identify security weaknesses. Annual third-party VAPT is performed by reputable security firms accredited by BSSN and ASPI, with executive summaries available upon request.
Critical exploitable vulnerabilities on external-facing assets are remediated within 3 days, with risk-based SLAs for lower severities. High and critical findings require remediation or compensating controls before production deployment.

All customer data is encrypted at rest using AES-256 encryption at both database and storage levels (Full Disk Encryption). Encryption keys are managed via Alibaba Cloud KMS with centralized key management, access controls, and automatic key rotation.

All data in transit is encrypted using TLS 1.2 or TLS 1.3 with strong cipher suites (ECDHE-RSA-AES-256-GCM). SSL/TLS certificates are managed and renewed automatically to ensure continuous encrypted communications between users and the Mekari systems.

Information assets are classified based on value, legal requirements, and sensitivity following the CIA triad (Confidentiality, Integrity, Availability). Each classification level has defined handling, access control, and protection procedures aligned with ISO 27001:2022 standards.

Automated daily backups with geo-redundant storage across separate availability zones within Indonesia. Disaster Recovery Plan (DRP) implemented with Recovery Time Objective (RTO) and Recovery Point Objective (RPO) of less than 1 hour for critical services. All backups are encrypted using AES-256.

Customer data is retained for the duration of the subscription and in accordance with applicable legal and regulatory requirements. Upon termination or deletion request, data is securely deleted following documented sanitization procedures to ensure complete and irreversible removal.

Encryption keys are centrally managed through Alibaba Cloud KMS with automated rotation features, strict access controls, and comprehensive audit logging.

MFA is mandatory for all user accounts and administrative access to cloud infrastructure, servers, and internal applications. The Mekari Qontak systems support TOTP, authenticator apps, and SMS/email verification, providing an additional security layer beyond passwords.

Access is granted based on job functions and responsibilities using a documented access control matrix. Granular permissions are defined and enforced across all systems and databases to ensure users only access resources necessary for their roles.

Enterprise SSO integration available via SAML 2.0 and OpenID Connect (OIDC) with support for identity providers including Google Workspace and Azure AD. Centralized identity management streamlines user provisioning, deprovisioning, and systematic authentication policy enforcement.

All access follows the principle of least privilege, granting users only the minimum permissions required to perform their duties. Privileged access requires formal approval and undergoes quarterly access reviews to ensure continued business need.

User sessions are secured using OAuth 2.0 tokens with automatic timeout after predefined periods of inactivity. Concurrent session limits are configurable by administrators to prevent unauthorized access.

All authentication events, login attempts, configuration changes, privileged access, and sensitive data access are automatically logged in tamper-proof audit trails. Logs are monitored in real-time by the security team and retained for compliance and forensic analysis.

Security is embedded throughout the Software Development Lifecycle with documented policies covering all phases from development to deployment. Security checks are integrated at every stage using shift-left security practices and quality gates before code reaches production, including threat modeling, secure code review, and security testing.

Static Application Security Testing (SAST) integrated into the CI/CD pipeline to detect vulnerabilities at the source code level. Dynamic Application Security Testing (DAST) and periodic penetration testing are conducted on running applications to identify runtime vulnerabilities before production deployment.

Third-party libraries and dependencies are continuously monitored using automated scanning tools to detect known vulnerabilities (CVEs) and prevent the use of outdated or vulnerable components. Dependencies are assessed and updated regularly as part of the secure development process.

All code changes require mandatory peer review through the Request For Change (RFC) process with branch protection enabled. Changes must be reviewed by at least one additional developer to ensure compliance with secure coding standards before merging to production branches.

APIs are secured using OAuth 2.0 authentication, API key management, HTTPS/TLS 1.2+ encryption, rate limiting, and input validation. Web Application Firewall (WAF) provides additional protection against common API attacks including OWASP API Security Top 10 threats.

Responsible vulnerability disclosure program established for internal and external security findings. Security researchers and clients can report vulnerabilities to infosec@mekari.com. Vulnerability assessment results and security summaries available to clients upon request under NDA.

24/7 real-time monitoring of all infrastructure and applications using centralized log management systems. Audit logs capture login attempts, sensitive data access, and system changes in tamper-proof format with automated alerting for suspicious activities and security anomalies.

Dedicated Security Operations Center (SOC) with documented Incident Response Plan covering identification, triage, escalation, containment, and recovery phases. Incident severity levels are defined with measurable Mean Time to Respond (MTTR) targets and established communication protocols for stakeholder notification.

All production changes follow a formal Request For Change (RFC) process requiring peer review, testing in staging environments, and approval before implementation. Documented rollback procedures ensure rapid recovery from failed changes to minimize service disruption.

Comprehensive Disaster Recovery Plan (DRP) with daily data replication across separate availability zones within Indonesia. Annual DR drills conducted to validate recovery procedures. Recovery Time Objective (RTO) and Recovery Point Objective (RPO) of less than 1 hour for critical services.

Mandatory security awareness training for all employees during onboarding and monthly thereafter, covering current threat landscapes and internal security policies. Engineering teams receive additional secure coding awareness to address application-specific security risks.

Mekari complies with Undang-Undang Perlindungan Data Pribadi (UU PDP) No. 27/2022, Indonesia’s personal data protection law. A designated Data Protection Officer (DPO) ensures ongoing compliance with data subject rights and regulatory requirements.

All customer data is processed and stored exclusively in Alibaba Cloud’s Indonesia data centers in compliance with Indonesian electronic system regulations. Data does not leave Indonesian territory without explicit customer consent or instruction.

Comprehensive DPA available as part of service contracts, defining Mekari’s responsibilities as a data processor, including security measures, confidentiality obligations, sub-processor management, and adherence to customer instructions as the data controller.

Data subjects can exercise their right to erasure in accordance with UU PDP requirements. Upon verified request, personal data is permanently deleted from active systems and backups following documented sanitization procedures within defined retention policies.

Privacy principles are embedded from the initial product development phase through the Secure SDLC framework. Data minimization, purpose limitation, and access controls are fundamental requirements before any feature release.

Transparent consent management mechanisms provide users with clear information about data processing purposes. Explicit consent is obtained before processing activities, and users can manage their consent preferences through accessible controls.

Comprehensive background verification conducted for all employees prior to onboarding, including identity verification, employment history, educational credentials, and professional references to ensure integrity of personnel handling customer data.

All employees and third-party contractors are required to sign Non-Disclosure Agreements (NDA) and confidentiality clauses in employment contracts before accessing any company or customer data. Confidentiality obligations remain binding post-employment.

Mandatory security awareness training for all employees during onboarding and periodically thereafter. Training programs cover sensitive data handling, phishing recognition, password policies, social engineering, and current security threats. Regular phishing simulations and security bulletins reinforce security practices.

Documented Acceptable Use Policy governs employee rights and responsibilities for using company systems, devices, network resources, and internet access. AUP prevents misuse of corporate assets and establishes accountability for security violations.

Formal offboarding process ensures immediate revocation of all system access upon employment termination or role changes. Process includes asset return, account deactivation, access reviews, and confidentiality obligation reminders to mitigate insider threats.