MUST runs your back office: payslips, CPF, invoices, employee records. This page sets out where that data lives, the controls around it, and where we stand on formal certification. We only list what is in place today.
Where we are with each framework. A framework is marked "Certified" only once the certificate or report has been issued.
We handle personal data under the Personal Data Protection Act 2012. Our privacy policy is public.
Self-assessment against the Cyber Security Agency of Singapore's Cyber Essentials mark is under way.
We are building our information security management system: scope, risk register, Statement of Applicability, policies and procedures.
Not yet accredited. Technical testing on the InvoiceNow network is complete and the application to IMDA is being finalised.
On our roadmap after ISO/IEC 27001: Type I first, then Type II.
Planned once our data protection programme and DPO are in place.
MUST software is built for the InvoiceNow (Peppol) network and IRAS requirements. An item marked "Pending" is not yet in place. It moves to "Certified" or "In effect" only once it has been granted.
Controls running in production today.
Security and compliance work that is scheduled but not yet complete. We keep this list current so you know exactly what is and is not in place.
Last reviewed: 26 September 2026
| Item | Area | Status |
|---|---|---|
| MFA enforced for all administrator accounts Available to every user today; becoming mandatory for admins | Access control | Pending |
| Independent penetration test | Application security | Pending |
| Immutable (locked) retention on audit logs | Monitoring | Pending |
| Mandatory review on protected code branches | Secure development | Pending |
| Staff security briefing and incident tabletop exercise | People | Pending |
| Named Data Protection Officer | Privacy | Pending |
| Approval of information security policies 13 policies drafted, awaiting management review | Governance | Pending |
| CSA Cyber Essentials submission | Certification | In progress |
| IMDA InvoiceNow Solution Provider application | Accreditation | Pending |
| Singpass sign-in for MUST HRMS in production | Identity | Pending |
Third parties that process customer data on our behalf when you use MUST software.
| Provider | Purpose | Data location | Status |
|---|---|---|---|
| Google Cloud | Application hosting, databases, backups and logs | Singapore | Active |
| Cloudflare | DNS, and routing of email sent to our customer-support addresses | Global network | Active |
| Tickstar | Peppol access point for InvoiceNow. E-invoices leave our gateway in Singapore and are exchanged over the Peppol network through Tickstar | Ireland (EU) | Pending |
| GovTech (Singpass) | Employee sign-in to MUST HRMS with Singpass | Singapore | Pending |
| Provider | Purpose |
|---|---|
| Cloudflare | Content delivery and cookieless web analytics |
| DigitalOcean | Website hosting |
| Google Ads | Conversion measurement for enquiries |
| FormSubmit | Fallback delivery for contact forms |
"Pending" providers are contracted or in testing but do not yet process customer data. We update this list before a new sub-processor starts handling customer data. Customers under contract can ask to be notified of changes.
Public policies are linked directly. Other documents are shared with customers and prospects on request.
Questions customers often ask during vendor review.
In Singapore. The application, its databases and all backups run in Google Cloud's asia-southeast1 region.
Yes. Each customer has a dedicated database. Customers with custom modules also get their own application deployment.
You own your data. You can export your records to Excel or CSV at any time. When you leave, we can hand over a full export on request.
Not yet. We are working towards CSA Cyber Essentials and ISO/IEC 27001:2022, and will publish each certificate here once it is issued. The "Pending work" section shows what remains. Until then we can take you through our controls in a security review.
No customer data is sent to third-party AI services today. If that changes, the provider will be added to the sub-processor list first.
We follow the notification duties in the PDPA. That means notifying affected customers without undue delay and, where required, notifying the Personal Data Protection Commission within three calendar days of assessing that a breach is notifiable.
Grant applications are always submitted by you: we never ask for your Corppass or Singpass credentials. Our team will never ask for your password by email, WhatsApp or phone.
Changes to our security programme and this page.
This page is the single reference for how MUST protects customer data. Unfinished work is listed openly under "Pending work". We will post here when a certification is issued, a sub-processor changes, or a pending item is completed.
Email security@must.com.sg with the details. We read every report and will not take action against good-faith research. Machine-readable contact: security.txt.
