Security & Compliance Overview

Information Security

Booppa implements organizational, technical, and procedural controls designed to protect customer data and system integrity.

• Role-based access control (RBAC)
• Multi-factor authentication for privileged access
• Centralized logging and monitoring
• Secure configuration and vulnerability management
• Incident response and escalation procedures
• Regular backup and recovery processes

Cloud Infrastructure & Hosting

• SaaS platform hosted on Amazon Web Services (AWS), Singapore Region
• Infrastructure designed for availability, scalability, and resilience
• Logical segregation of customer environments
• Data residency in Singapore, unless otherwise agreed

Cloud Security Framework Alignment

Booppa’s cloud security controls are aligned with the Singapore Multi-Tier Cloud Security (MTCS) Level 1 baseline, based on internal self-assessment against applicable control domains.

This alignment includes:

• Access control and identity management
• Asset and configuration management
• Logging, monitoring, and incident handling
• Backup, recovery, and operational security practices

MTCS alignment does not constitute certification.

Data Protection & PDPA Alignment

Booppa is designed to support organizations in meeting their obligations under Singapore’s Personal Data Protection Act (PDPA).

Data protection measures include:

• Data classification and access restrictions
• Encryption in transit and at rest
• Defined data retention and deletion processes
• Separation of personal data storage from blockchain verification layers

Blockchain & Personal Data

• No personal data is stored on-chain
• Blockchain is used exclusively for cryptographic hashes and integrity proofs
• Personal data remains fully manageable off-chain, supporting data protection and erasure requirements

This architectural approach is consistent with PDPC guidance discussing the use of off-chain storage combined with on-chain cryptographic verification.

Blockchain Evidence & Audit Integrity

Booppa provides blockchain-verified audit trails designed to support:

• Integrity verification
• Tamper detection
• Traceability of records
• Chain-of-custody documentation

Each notarization event can be supported by a structured Evidence Pack, which may include:

• Original data or document
• Associated metadata
• Cryptographic hash
• Blockchain transaction reference
• Timestamp and verification artifacts
• System and access logs

Court Admissibility Considerations

Publicly available legal commentary and regulatory guidance in Singapore indicate that electronic and blockchain-based records may be accepted as evidence where authenticity, integrity, and provenance can be demonstrated.

Legal commentary published by the Singapore Law Gazette has discussed that blockchain records may constitute original documents where their immutability and provenance are properly established.

Recent Singapore High Court decisions involving crypto and digital assets demonstrate judicial familiarity with blockchain-based systems, provided that the underlying technical mechanisms are clearly explained.

Booppa Intelligence is designed to generate court-admissible evidence, subject to judicial acceptance, and provides technical documentation to support evidentiary use.

Regulatory Positioning

Booppa Intelligence:

• Is not a regulator
• Is not a certification authority
• Does not provide legal or regulatory advice

The platform supports internal compliance and audit processes. Customers remain responsible for their own legal and regulatory compliance obligations.

Certifications & Roadmap

• MTCS Level 1 — Aligned (self-assessed)
• PDPA — Architectural alignment with applicable requirements

Roadmap includes:

• MTCS Level 1 certification
• ISO/IEC 27001

Availability of Documentation

Additional security, compliance, and technical documentation is available upon request, including:

• Detailed architecture diagrams
• Evidence Pack examples
• RFP and due diligence responses

AI and Automated Processing

Booppa leverages AI for enhanced report narratives and compliance insights, while ensuring full PDPA alignment:

• No personal data is used for AI training or processing.
• AI outputs are deterministic and auditable, with human oversight.
• Rule-based automation combined with selective AI for explanatory summaries.

This approach follows PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (2024-2025), minimizing risks while delivering smarter evidence.