Security & Compliance
Handled carefully, stated plainly
Encrypted in transit and at rest, isolated per brand, stored in your region, and never used to train anyone's models. Anything unfinished is labeled in progress.
Where we stand
What is in place today, and what is still in progress.
Independent security testing
The Purands application is tested by Privacy Ninja Pte Ltd, a penetration testing provider licensed by the Cyber Security Agency of Singapore (Licence CS/PTS/C-2022-0128R). Testing is carried out by CREST-registered and OSCP+ certified penetration testers using an authenticated grey-box methodology, with findings rated against CVSS and the OWASP Risk Rating Methodology.
Our most recent assessment was completed in July 2026. All identified findings were remediated and independently revalidated. We commission testing on an annual basis and after significant platform changes.
A summary attestation is available to customers and prospects on request.
In-region data residency
Stored in-region by default. Ask us to confirm your region before you sign.
Customer-controlled data
You decide what Purands holds.
What protects your data
These apply to every brand running on Purands.
Encrypted in transit and at rest
Customer data is encrypted while it travels between systems, and while it sits in storage.
- In transit
- Encrypted
- At rest
- Encrypted
One brand, one tenant
Every brand's data is separated from every other brand's. Internal access is granted by role, not by default.
- Separation
- Per brand
- Internal access
- Role-based
Stored in your region
Data is held in-region by default. Where it has to cross a border, contractual safeguards travel with it.
- Default
- In-region
- Cross-border
- Safeguarded
Never training data, never sold
Your customer data is not used to train third-party AI models, and is never sold or traded for marketing.
- Third-party training
- Never
- Sold or traded
- Never
How we handle your data
Privacy-first architecture
One profile per customer, owned by your brand - not copies across separate tools. See Profiling & Identities.
We process on your instructions
For your customer data, your brand is the controller and Purands the processor. Written into our privacy policy.
Kept only while it is needed
Held as long as the purpose requires, then anonymised or securely deleted. Set out in our privacy policy.
Your data, your call
Email meg@purands.com and tell us what you need - our team handles it.
What your reviewer can ask for
Send your questionnaire and we will work through it. These are available on request.
Found a security issue?
Tell us directly, so we can fix it before anyone else finds it.
Where to send it
Email meg@purands.com with the subject "Security report". It reaches our team directly.
What to include
The page or host affected, the steps to reproduce it, and what someone could do with it. A way to reach you helps us follow up.
How to test
Use only your own account. Do not access, change or delete anyone else's data, and do not slow the service down. Give us time to fix it before you publish.
Security questions?
Ask them early
Send your security questionnaire or residency questions to meg@purands.com - or book a demo and we will walk your reviewer through it.