Customer Security Statement
How Morning Geek protects the systems and data we build, host and support for our customers.
Morning Geek builds, hosts and supports CRM, booking, membership and access systems for our customers. When we handle your data, we do so on your behalf as a data intermediary under Singapore's Personal Data Protection Act. Security is part of the quality of every service we deliver, and this statement sets out what we commit to.
1Our security commitments
- Where your data is kept
- Our policy is to host customer systems and data in Singapore data centres. Any exception needs our Director's prior approval and a check of your contract.
- Access
- Only named staff who need access for their role can reach customer systems. Every account uses multi-factor authentication, access is reviewed regularly, and it is removed promptly when no longer needed.
- Company devices
- Staff work only on company laptops with full-disk encryption, malware protection, a firewall and automatic screen lock.
- Backups
- Customer production systems and data are backed up at least daily and encrypted. Our backup standard also requires a separate, isolated copy kept in Singapore and regular tests that backups can be restored.
- Secure development
- Every change is reviewed before release and passes automated checks for exposed secrets, code and dependency issues. New third-party components are checked before use, and our systems are assessed for vulnerabilities at least once a year.
- Our people
- Every staff member signs a confidentiality undertaking, is trained in security when they join and every year, and follows written security policies approved by our Director.
- Incidents
- We have a written incident response plan, which we exercise at least once a year. If an incident affects your data or service, we tell you without undue delay and support any notification you need to make.
2Contact us
Report a security concern or ask a security question at [email protected]. The address is monitored Monday to Friday, 9:00 AM to 6:00 PM Singapore time, with escalation for urgent issues.
3About this statement
This statement describes our security practices. It does not change the terms of your contract with us. We review it at least once a year and after any material change, and publish each version on our website.