Legal & Compliance.
Last Updated: May 12, 2026 • Version 2.1 (PDPA Compliant)
Data Residency
Data Protection
Encryption
Support
Section 01 — Privacy as a Human Right
We believe data sovereignty is a fundamental right. Our platform is architected to ensure Singaporean businesses retain 100% control over customer data. Our Sovereign AI Mesh ensures your private data is never used to train third-party models.
Singapore (PDPA)
Full alignment with the Personal Data Protection Act of Singapore.
ASEAN Standards
Standardized data protection practices meeting regional requirements.
Section 02 — Technical Protection
Security is at the core of our protocol. All data moving between KopasAI Cloud and WhatsApp Business API is protected by:
- TLS 1.3 Encryption for data in transit.
- AES-256 Encryption for data at rest.
- Multi-factor authentication for the dashboard is not available yet; protect your account with a strong password.
For deep technical details on our infrastructure security:
Explore Security Whitepaper →Section 03 — Sub-processors
We use the following sub-processors to run KopasAI. Each row shows what they do and where that part of the service runs.
| Entity | Service | Location |
|---|---|---|
| Google Cloud | Infrastructure & Data Storage | the ASEAN region |
| Meta Platforms | WhatsApp API Operations | Global (Edge Nodes) |
| Midtrans | Payment processing for subscriptions and, on Menengah and above, customer payments | ASEAN |
| Google Analytics | Website Analytics (only if you allow it) | Global |
| Google & Groq | AI reply generation (Google Gemini, with Groq as a backup) | Global |
Section 04 — Data Subject Rights
Right to be Forgotten
SME owners can request permanent deletion of their account and data. We purge all records within 30 days of a valid request.
View Deletion Guide →Data Protection Officer (DPO):
Privacy & Compliance Team
legal@kopasai.com
KopasAI Sovereign Hub • ASEAN