Security and trust

Security, data and AI controls

For your IT and finance teams: who owns the code and the data, where the system runs, how agents are limited and logged, and how PDPA works with us. We list only what we do today.

Book a scoping call How we work

AP invoice agentFinance moduleAgent on

Can read: Supplier invoicesPurchase ordersGoods received
Can draft: Supplier bills
No access: Bank detailsPayrollPayments

Control level

Suggest
Draft for approvalSelected
Act within limitsNot offered for this agent

Act within limits is not offered for this agent. A bill is posted only after a person in finance approves it, and paying it is a separate step a person always takes.

Last logged action

10:14 · Drafted bill BW-4471 from Bluewater Corrugated, S$1,177.20 incl. 9% GST. Waiting for the finance executive to approve it.

Sample data. Harbourline Supplies Pte Ltd, like every other company named here, is not a real company.

Ownership

Your code, your data, your choice of hosting.

What we build for you belongs to you. Everything else on this page starts from that.

You own the source code
You own the full source code of what we build for you, including the core code it runs on. Anyone you hire can read it, change it or run it. SleekDigital keeps only its build tooling.
You control the data
Your records, the approval history and the agent action log live in your system. You decide who can see them.
Run it where you choose
Run it on our hosting, or in your own cloud account. We settle which with you in the scoping call.
No per-user licence fees
Because you own the system, there is nothing to license per user. Adding staff adds no licence fees.

Data flow

Where your data goes.

The system we build, in one diagram: what talks to what, and where a person steps in. Which model provider the agents use is agreed with you in the scoping call.

AgentA person decidesOutside your system

1
Your userstoThe app
Your staff sign in over an encrypted (HTTPS) connection. Their role decides what they can see and do.
2
The apptoYour database
The app reads and writes your records. The database runs on our hosting or in your own cloud account.
3
The apptoAgent runtime
An agent reads only the records its job allows. It has its own role, like a member of staff.
4
Agent runtimetoModel provider
To read a document or write a draft, the agent sends the task to the model provider you agreed with us.
5
Agent runtimetoApproval queue
The result comes back as a draft in the approval queue. By default, nothing in your records has changed yet.
6
Approval queuetoThe app
A person approves, edits or rejects the draft. Only then is the change written to your database.
7
Agent runtimetoAction log
Every agent action is logged in your system: what the agent proposed, and who approved or rejected it.

Agent controls

Every agent has limits, a switch and a log.

Agents prepare the work. Your team approves it. Each agent runs at one of three control levels, set per action.

Level 1
Suggest
The agent recommends. A person does the work.
Level 2Default
Draft for approval
The agent prepares the record and waits. Nothing changes until a person approves. This is the default.
Level 3
Act within limits
Opt in per action, under a S$ limit you set. Payments, deletions and messages to customers or suppliers always stop at a person.

Least access per agent
Each agent has its own role with only the records and actions its job needs. The AP invoice agent reads supplier invoices. It cannot see payroll or bank details.
S$ limits you set
If you opt an action into Act within limits, you set the S$ ceiling. Above it, the agent drafts and waits. Payments, deletions and messages to customers or suppliers always stop at a person, and each agent's page lists what it never does, whatever the limit.
A switch to turn it off
Every agent has an off switch. An admin can turn one off at any time, for example while a price list is being updated, and the work goes back to your team.
Every action logged
Every agent action is logged in your system: what the agent proposed, and who approved or rejected it.

Action log

Harbourline Supplies · Tuesday

10:14
Proposed by AP invoice agent
Bill BW-4471 from Bluewater Corrugated, matched to PO-1052 and goods received note GRN-2210.
Decided by Finance executive
ApprovedApproved at 10:31
Amount: S$1,177.20
10:20
Proposed by Collections agent
Reminder to Orchid Bay Hardware for INV-2207, 14 days overdue.
Decided by Credit controller
ApprovedEdited the wording, approved at 10:42
Amount: S$3,270.00
10:26
Proposed by Purchase order agent
PO-1058 to Bluewater Corrugated for 300 cartons.
Decided by Operations manager
RejectedRejected at 10:50: stock arrives Thursday
Amount: S$1,471.50
11:02
Proposed by Quotation agent
No action. Switched off while the price list is updated.
Decided by System admin
Agent offTurned the agent off at 11:02
No amount

Amounts include 9% GST. The log is kept in your system.

Sample data. Harbourline Supplies Pte Ltd, like every other company named here, is not a real company.

Application security

What we build in.

These practices are part of every build. If your procurement checklist asks for something not on this page, bring it to the scoping call and we will answer it item by item.

Role-based access
People and agents get roles. A role decides which screens, records and actions are open to it.
Encryption in transit
Traffic between browsers, the app and outside services runs over HTTPS.
Security checks in your phase plan
The security checks for your build, such as a review of the code against the OWASP Top 10 (the standard list of common web application risks), are written into your phase plan, so you know what is checked before a release is handed over.
People check every release
AI coding agents write the code and tests. Our tester runs the test plan, our ERP controller checks the business rules, and Lester Law, our founder, reviews every release.

PDPA

Personal data stays under your control.

Under Singapore's Personal Data Protection Act (PDPA), your organisation is responsible for the personal data in your system. We act on your instructions when we build it and when we run it.

You decide: What personal data the system holds, who can see it, and how long it is kept.
We act on your instructions: When we build the system and, if you choose our Run retainer, when we host and support it.
Agents and the model provider: Agents send tasks to the model provider you agree with us. In the scoping call we go through what each agent would send, so you can decide what it may see.
If a breach happens, we tell you: If we find a breach in a system we build or run for you, we tell you without undue delay, as the PDPA requires. The action log and your records are in your system, so you can assess it and, if needed, notify.

PDPA breach timeline

1
Breach suspectedDay 0
There are credible grounds to believe a breach happened, found by you, by a member of the public, or by us.
2
Assess itWithin 30 calendar days
Decide whether it is notifiable: likely to cause significant harm, or affecting 500 or more people.
3
Notify the PDPC3 calendar days after step 2
As soon as practicable, and no later than 3 calendar days after you determine the breach is notifiable.
4
Tell the people affectedWhere required
As soon as practicable, at the same time as or after notifying the PDPC.

Source: PDPC, Guide on Managing and Notifying Data Breaches under the PDPAChecked 7 Nov 2026.

AI governance

Designed with IMDA's agentic AI framework in mind.

IMDA released the Model AI Governance Framework for Agentic AI on 22 Jan 2026 and published version 1.5 on 20 May 2026. It is guidance, not a certification. We do not claim certification against it or compliance with it. This is how our agent controls line up with its four dimensions.

01Assess and bound the risks upfront
Each agent has one job and the least access that job needs. S$ limits cap what an opted-in action can do. Payments, deletions and messages to customers or suppliers always stop at a person.
02Make humans meaningfully accountable
By default, agents prepare and a person approves. The log names who approved or rejected each proposal.
03Implement technical controls and processes
Role-based access for people and agents, an off switch for every agent, and a log of every agent action. Our tester and ERP controller check each release.
04Enable end-user responsibility
Each draft is marked as agent work and shows what the agent checked, so the approver knows what they are signing off.

IMDA framework, version 1.5 (PDF)IMDA announcement, 20 May 2026

Plain answers

Certifications, contact and after go-live.

Certifications

We hold no security certifications today.

No CSA Cyber Trust mark, no ISO/IEC 27001, no Data Protection Trustmark. We would rather say so than show a badge we have not earned. If your procurement process requires one, tell us before scoping.

What we can do today: go through your security questionnaire with you, item by item, and show you the agent controls and action log on sample data.

Security questions

For a security question, a concern to report or your IT team's checklist, email us.

enquiry@sleekdigital.sg

After go-live

Run covers hosting, support and AI usage. Evolve is monthly build capacity for changes. Both are priced in the phase plan, and what Run covers, including support hours and how your team reaches us, is agreed with you and written into it.

Run and Evolve

Security questions we get asked.

Who owns the code and the data?

You do. You own the full source code of what we build, including the core code it runs on, and the data in the system is yours. SleekDigital keeps its build tooling: the generators, the module patterns and the instructions its AI coding agents follow.

Can we run the system in our own cloud account?

Yes. You can run it on our hosting or in your own cloud account. We agree which with you in the scoping call.

Which AI model do the agents use?

The model provider you agree with us. In the scoping call we go through the options and what each agent would send to the provider, so you can decide.

Can an agent change our records without anyone approving?

Not by default. By default, agents prepare and a person approves. You can opt a specific action into Act within limits, under a S$ limit you set. Payments, deletions and messages to customers or suppliers always stop at a person. Some agents never act alone on their main record: the AP invoice agent, for example, never posts a supplier bill without a person in finance approving it.

How do we stop an agent?

Every agent has an off switch. An admin can turn it off at any time and the work goes back to your team.

What does the action log record?

Every agent action, in your system: what the agent proposed, who approved or rejected it, and when.

Do you hold security or data protection certifications?

No. We hold none today, so we show no badges. If your procurement process requires one, tell us before scoping so you can decide early. If you have a security questionnaire, send it before the scoping call and we go through it with you item by item.

Do you follow IMDA's agentic AI framework?

Our agent controls were designed with IMDA's Model AI Governance Framework for Agentic AI in mind. The framework is guidance. We do not claim certification against it or compliance with it.

What happens if there is a data breach?

Your organisation assesses it and, if it is notifiable, notifies the PDPC no later than 3 calendar days after determining that. If we find a breach in a system we build or run for you, we tell you without undue delay, as the PDPA requires of an organisation processing data on your behalf. The action log and your records are in your system, so you have the facts to assess it.

How do we raise a security question or concern?

Email enquiry@sleekdigital.sg.

Bring your IT team's questions.

In 30 minutes we walk through the data flow, the agent controls and the hosting choice on sample data, and answer your checklist item by item.

Book a scoping call See pricing

Security, data and AI controls

You own the source code

You control the data

Run it where you choose

No per-user licence fees

Suggest

Draft for approval

Act within limits

Least access per agent

S$ limits you set

A switch to turn it off

Every action logged

Role-based access

Encryption in transit

Security checks in your phase plan

People check every release

01Assess and bound the risks upfront

02Make humans meaningfully accountable

03Implement technical controls and processes

04Enable end-user responsibility