Founded in 2025
Amanah Agent AI is an AI-powered customer engagement platform that helps businesses automate customer interactions through WhatsApp, Voice AI, and Chat AI with enterprise-grade security.
We recognize the confidentiality, integrity and availability of information and data created, maintained and hosted by us are vital to the success of our customers and partners.
Security is at the core of everything we build. Our platform is designed with enterprise-grade security controls including multi-layer encryption, comprehensive audit logging, and strict access controls to protect your data and ensure compliance with global standards including GDPR, ISO 27001, SOC 2, and Indonesian UU PDP regulations.
Founded in 2025
Compliances (4)
Here are the compliance frameworks that Amanah Agent AI follows which showcases our adherence to industry-standard security guidelines and practices.
GDPR
In progress
The General Data Protection Regulation, a comprehensive data protection law in the EU, governs how organizations must protect personal data and privacy.
Key Controls Implemented:
- Article 5 - Data Processing Principles (Lawfulness, purpose limitation)
- Article 7 - Consent Management (Granular consent tracking)
- Article 15 - Right of Access (Data export functionality)
- Article 16 - Right to Rectification (Data correction capabilities)
- Article 17 - Right to Erasure (Right to be forgotten)
- Article 18 - Processing Restriction (Ability to restrict processing)
- Article 20 - Data Portability (JSON format export)
- Article 32 - Security of Processing (Encryption, access controls)
- Article 33 - Breach Notification (72-hour notification procedures)
SOC 2
In progress
Service Organization Control framework covering Security, Availability, and Confidentiality trust service criteria. Our platform implements comprehensive controls for logical access, system operations, change management, and risk mitigation.
Key Controls Implemented:
- CC6.1 - Logical Access Controls (Role-based access, MFA enforcement)
- CC6.6 - Transmission Protection (TLS 1.3 encryption)
- CC6.7 - Vulnerability Management (Security headers, input validation)
- CC7.2 - Security Event Monitoring (Real-time threat detection)
- CC7.5 - Incident Response (Automated alerts, incident tracking)
ISO 27001 v2022
In progress
International standard for Information Security Management Systems (ISMS). We have implemented comprehensive controls aligned with ISO 27001:2022 requirements covering information security policies, access control, cryptography, operations security, and incident management.
Key Controls Implemented:
- A.9.4.2 - Secure Log-on Procedures (Device fingerprinting, MFA)
- A.9.4.3 - Password Management System (Account lockout protection)
- A.10.1.1 - Cryptographic Controls Policy (AES-256 encryption)
- A.10.1.2 - Key Management (AWS KMS integration)
- A.12.3.1 - Information Backup (Automated backup with verification)
- A.12.4.1 - Event Logging (90-day audit log retention)
- A.13.1.1 - Network Controls (Origin validation, CORS policies)
UU PDP Indonesia (Law No. 27/2022)
Compliant
Indonesian Personal Data Protection Law. We comply with local data protection requirements including consent management, data subject rights, data residency, and cross-border transfer controls.
Key Controls Implemented:
- Article 8 - Consent Requirements (Explicit consent collection)
- Article 10 - Right of Access (Data subject access requests)
- Article 12 - Right to Erasure (Data deletion upon request)
- Article 42 - Security Measures (Technical and organizational controls)
- Article 55 - Data Residency (Indonesia-based processing)
- Article 56 - Cross-border Transfer (Standard contractual clauses)
