Data safety

Mid Valley My day

Hosting and compliance

Where it is hosted: Go-live: on-premises at the ISEC site (ISEC’s own servers, Malaysia), backups on ISEC’s own storage · cloud option: AWS Malaysia (ap-southeast-5) · pilot today: Cloudflare
Who can see it: Role-based: each seat opens only its own pages, the server checks the seat again, and every patient-record view, print, export and change is written to the audit trail.
Encryption: In transit TLS 1.2+ · at rest AES-256-XTS · backups AES-256-GCM · IC, passport, payment fields: field-level planned
Backup and restore: Nightly encrypted export, restore to a point in time needs two super administrators with their own PINs, restore drills are logged.
PDPA 2010: Consent, access requests, correction, retention and erasure are handled in the PDPA and Records pages; break-glass access is logged and reviewed.
Audit: Append-only, hash-chained audit trail; it is exportable for the external auditor, who reads it through a time-boxed grant.
Finance data: Bills, receipts, vouchers and GL postings are kept as books with who / when / old value / new value; a change to a price, a bill or a finance rule is readable by the finance manager and CFO in the Audit trail.

Request	People	Restore to	Effect	State
Data safety is on the hosted pilot only

Journal

No run yet