Security Policy

iChatUp in Malaysia · Mozac Agency (202401002458) · Last updated: 27 September 2026 · 3 min read

This page describes the measures that protect your account, your customers’ conversations and your payments. What personal data is collected and why is in the Privacy Notice.

1. Payments

Card and bank details are entered on the payment gateway’s own secure checkout and are handled only by the gateway, which is certified to the card industry’s PCI DSS standard. They never reach our servers and we cannot see or store them. We keep only the payment reference, amount, plan and status.

2. Data in transit

Every connection to ichatup.my — the website, your dashboard and checkout — uses HTTPS (TLS encryption).

3. Your account

Passwords are stored only as one-way hashes; nobody, including us, can read them.
New accounts confirm their e-mail address with a one-time code.
Sign-in attempts are rate-limited.
You decide who on your team can sign in, and you can remove a team member at any time.

4. Your business and customer data

Each business has its own workspace. Every record is tied to one workspace and cannot be read from another.
Access tokens for the official WhatsApp Cloud API are stored encrypted.
Conversations are used only to answer your customers and are not used to train AI models.
You can export or delete your workspace data yourself; deletion is completed within 24 hours (see data deletion).

5. Infrastructure and backups

The platform is operated by iChatUp on cloud servers outside Malaysia. The database is backed up every night to encrypted storage that is not publicly accessible, and backups are kept for 30 days. Platform health is monitored continuously.

6. Who can access data

Access to production systems is limited to the people who operate the platform. Mozac Agency staff can see your account and billing details in order to support you. Nobody contacts your customers for our own purposes.

7. Your part

Use a strong password that you do not use elsewhere, keep your WhatsApp account’s two-step verification on, and remove team members who leave your business.

8. Reporting a security problem

If you believe you have found a security problem, or your account has been used without your permission, write to basit@mozac.my. We acknowledge reports within 2 business days. If a breach affects your data, we tell you without undue delay.