CLMS CloudSecurity
How CLMS Cloud is hosted and protected, and who we rely on. Written for the lender evaluating us and for the auditor who will ask. Operated by ES Vision, Malaysia.
Where your data lives
The application, its databases and its backups run in a secured data centre hosted in the region matching your business location. Cloudflare sits in front for DNS, TLS and content delivery. Each lender’s workspace has its own database rather than a shared table with a tenant column, so one customer’s records are separated from another’s at the database level.
Protecting accounts
- Passwords are stored as one-way bcrypt hashes — they cannot be read back, by us or by anyone with a copy of the database.
- Sessions use signed cookies scoped to the workspace; a session issued for one workspace is refused by another.
- Sign-in is protected against automated guessing.
- Access inside a workspace is set by level and by custom roles built from capabilities and team scope, so staff see only what their role allows.
Protecting data
- Traffic is encrypted in transit over HTTPS.
- Customer files — identity documents, agreements, photos — are held in private object storage and served only through the application after sign-in, never from a public URL.
- Database backups are taken nightly and encrypted.
- Database queries are parameterised, which is what keeps SQL injection out.
- Every customer, loan, payment and status change is written to an audit log with the user and timestamp. Deletions go to a recycle bin or are restricted to the workspace owner.
Sub-processors
| Provider | What they do | Where |
|---|---|---|
| Cloud infrastructure provider | Hosting, database, object storage, backups | Regional data centre |
| Cloudflare | DNS, TLS, CDN, bot protection (Turnstile) | Global edge |
| Stripe | Subscription payments. Card details go to Stripe and never touch our servers | Global |
| Telegram | Optional. Only if a workspace turns on login codes and alerts | Global |
We will tell customers before adding a sub-processor that handles workspace data.
What we do not claim
We would rather be accurate than impressive. CLMS Cloud does not currently hold ISO 27001, SOC 2 or any comparable certification, and has not been through an independent penetration test. Two-factor authentication and single sign-on are not available yet. We are a small team, and this page will change as that changes — the date below tells you when it was last true.
Reporting a vulnerability
If you believe you have found a security problem, email [email protected] with enough detail to reproduce it, or message us on WhatsApp. Please give us a reasonable chance to fix it before disclosing it publicly. We will not pursue action against anyone who reports a genuine issue in good faith and does not access or alter other people’s data while doing so. We do not run a paid bug bounty.
Data processing agreement
Customers who need a signed data processing agreement should ask; we provide one on request. See also our Privacy Policy and Terms of Use.
Last updated: 17 September 2026 · ES Vision, Malaysia · CLMS Cloud · Privacy · Terms · Security