Data Security Policy

Hunter Analytix Sdn. Bhd. is committed to implementing and maintaining a comprehensive Information Security Management System (ISMS) aligned with internationally recognised standards and regulatory requirements.

This includes compliance with:

• ISO/IEC 27001:2022
• Bank Negara Malaysia Risk Management in Technology (RMiT) Guidelines
• Malaysia Personal Data Protection Act (PDPA)

We operate under a bank-grade, zero-trust security architecture to ensure that all data assets are protected with the same level of rigour expected of regulated financial institutions.

• Protect the confidentiality, integrity, and availability of data
• Establish a structured Information Security Management System (ISMS)
• Ensure compliance with applicable laws, regulations, and standards
• Safeguard trust among users, financial institutions, partners, and regulators
• Enable secure and scalable operations across Malaysia and international markets

• All employees, contractors, agents, and representatives
• All systems, platforms, and infrastructure supporting Hunter Repo
• All data processed, stored, or transmitted
• All third-party vendors, integrations, and service providers

• An Information Security Committee (ISC)
• Designated security leadership (including CISO-equivalent role)
• Defined reporting lines to senior management

• Access Control Policy
• Cryptography Policy
• Incident Response Policy
• Vendor Risk Management Policy
• Business Continuity and Disaster Recovery Policy
• Data Classification and Handling Policy

• Identification of risks to information assets
• Risk assessment and impact analysis
• Risk treatment and mitigation planning
• Maintenance of a risk register
• Continuous monitoring and periodic review

• Restricted, personal, financial, and enforcement data
• Confidential, operational and analytical data
• Internal Use, non-public internal data
• Public, information approved for public disclosure

Restricted data is protected with the highest level of security, including encryption, strict access controls, and full audit logging.

• Role-Based Access Control (RBAC)
• Least privilege principle
• Multi-Factor Authentication (MFA)
• Privileged Access Management (PAM)
• Periodic access review and recertification

• Data at rest encrypted using AES-256
• Data in transit protected using TLS 1.2 or higher
• Encryption keys securely managed with restricted access
• Data masking, tokenization, and anonymization where applicable

• Secure Software Development Lifecycle (SSDLC)
• Code reviews and security testing
• Protection against OWASP Top 10
• API security with authentication, authorisation, and rate limiting

• Centralised logging of all system and user activities
• Real-time monitoring of security events
• AI-driven anomaly detection
• Tamper-resistant audit logs

• Detection and identification
• Containment and mitigation
• Investigation and root cause analysis
• System recovery and restoration
• Post-incident review and improvement

• Regular encrypted data backups
• Defined recovery objectives (RTO and RPO)
• Redundant systems and failover capabilities
• Periodic disaster recovery testing

• Security due diligence before onboarding
• Execution of Data Processing Agreements (DPA)
• Continuous monitoring of vendor compliance

• Secure mobile device authentication
• Device-level encryption
• Remote wipe capability
• Anti-tampering and anti-reverse engineering protections
• Full tracking and audit logging of field activities

• Malaysia Personal Data Protection Act (PDPA)
• Bank Negara Malaysia RMiT Guidelines
• ISO/IEC 27001 standards
• Applicable international data protection regulations

• Plan, Do, Check, Act (PDCA) methodology
• Ongoing threat assessment
• Regular updates to policies and controls

Security & Compliance Office, Hunter Analytix Sdn. Bhd.

Email: security@hunterrepo.com