Compliance roadmap
What is in place today and what we are working towards. We do not claim any certification until it has been issued.
| Framework | Where we are | Status |
|---|---|---|
| Malaysia Personal Data Protection Act 2010 (as amended) | Privacy Policy in effect; Data Processing Agreement and data protection contact in place before launch | In progress |
| Data Processing Agreement for customers | Drafted; available to enterprise customers at onboarding | At launch |
| Provider usage policies | Passed through to customers in our Acceptable Use Policy; regional eligibility enforced in the gateway | At launch |
| Sanctions screening at onboarding | Business verification and screening before production access | In progress |
| GDPR transfers (EU customer data) | Standard Contractual Clauses to be offered in the DPA | Planned |
| SOC 2 Type I | Readiness assessment after launch | Planned |
| SOC 2 Type II | Observation period follows Type I | Planned |
| ISO/IEC 27001 | Under evaluation | Planned |
| ISO/IEC 42001 (AI management systems) | Under evaluation | Planned |
Our approach to AI governance follows the principles of Malaysia's National Guidelines on AI Governance and Ethics.
Prospective customers and partners can request our policy documents and security questionnaire responses at security@nexoviaai.com.