Privacy by design
Data minimisation, PII masking, learner Notes 100% private.
Published 22 July 2026
Bursanalar
Public security and compliance register of PT Global Makmur Madani. Not a broker. No certification theatre.
We show controls that are live, partial, or still on the roadmap. There is no SOC 2 or ISO 27001 seal here - we do not hold those certifications.
Commitments you can inspect
Layered security
TLS, bcrypt, RBAC, Zod validation, Prisma, audit logs.
Regulatory posture
UU PDP in implementation, POJK 6/2026, PCI delegated.
Honest transparency
We do not claim certifications we have not earned.
Framework status
Honest status - not marketing badges.
UU PDP
Basic controls are live. Formal DPO and full export/delete before launch.
PCI-DSS
No PAN/CVV stored. Target SAQ A via a hosted payment page.
POJK 6/2026
No profit promises. Mentor curriculum reviewed before publish.
SOC 2 Type II
Not held. Readiness assessment planned for 2027.
ISO 27001
Not held. Used as a checklist, not a claim.
PSE Kominfo
Registration before a full public launch.
Controls
Public matrix. Internal detail is withheld.
Technical security
- Live
TLS 1.2+
Encryption for all client-server traffic
- Live
bcrypt passwords
Password hashes at cost ≥ 12
- Live
RBAC
Role-based access on API and admin
- Live
Rate limiting
Throttles on auth and API endpoints
Organizational security
- Live
Incident response
3-24h breach SOP
- Live
Security training
Engineer onboarding
- Live
Change management
PR review on sensitive code
- Partial
Vendor assessment
Sub-processor review
Admin access (public)
- Live
Learner Notes
Hard deny - no break-glass
- Live
Card data
Not stored; admin access denied
- Live
Passwords / hashes
Admins cannot read them
- Partial
User email
Masked for admin and support
Resources
Documents you can open without an NDA. No audit report exists yet.