1. Security Measures
1.1 Multi-Layered Security Architecture
RoyaleMaide implements a comprehensive, multi-layered security approach to protect your personal data:
Network Security
- Firewall Protection: Advanced web application firewalls (WAF) to block
malicious traffic
- DDoS Mitigation: Distributed denial-of-service protection and traffic
filtering
- Intrusion Detection: 24/7 monitoring for unauthorized access attempts
- VPN Requirements: Secure access for administrative functions
Application Security
- Secure Coding: Industry-standard secure development practices
- Regular Testing: Automated security scanning and penetration testing
- Input Validation: Protection against SQL injection and XSS attacks
- Session Management: Secure session handling and timeout policies
User Authentication
- Multi-Factor Authentication: Optional 2FA for enhanced account security
- Strong Password Requirements: Minimum complexity standards
- Account Lockout: Protection against brute force attacks
- Social Login Security: Secure OAuth integration
1.2 Security Certifications & Standards
Our security practices align with international standards:
- ISO 27001: Information Security Management System
- SOC 2 Type II: Security, availability, and confidentiality controls
- OWASP Top 10: Protection against common web application vulnerabilities
- NIST Framework: Cybersecurity risk management guidelines
2. Data Encryption
2.1 Encryption in Transit
All data transmitted between your device and our servers is protected using industry-standard
encryption:
TLS 1.3 Protocol
Latest Transport Layer Security protocol for secure communications
Perfect Forward Secrecy
Each session uses unique encryption keys to prevent future decryption
HSTS Headers
HTTP Strict Transport Security to prevent downgrade attacks
2.2 Encryption at Rest
All stored data is encrypted using advanced encryption standards:
- AES-256 Encryption: Military-grade encryption for database storage
- Key Management: Secure key storage and rotation practices
- Encrypted Backups: All backup data is encrypted before storage
- Hardware Security Modules: Dedicated HSMs for critical encryption keys
FIPS 140-2 Compliance
Our encryption implementations meet Federal Information Processing Standards for government and
enterprise use.
3. Access Controls
3.1 Principle of Least Privilege
We implement strict access controls following the principle of least privilege:
Role-Based Access Control (RBAC)
- Users can only access data necessary for their role
- Administrative functions require elevated permissions
- Customer support has limited, audited access to user data
- Third-party contractors have restricted, time-limited access
Identity Verification
- Multi-factor authentication for all admin accounts
- Regular access reviews and permission audits
- Immediate revocation of access upon role changes
- Biometric authentication for sensitive operations
3.2 Administrative Controls
Our administrative processes ensure secure data handling:
- Separation of Duties: Different people handle different aspects of data
processing
- Approval Workflows: Multiple approvals required for sensitive actions
- Audit Logging: Comprehensive logs of all data access and modifications
- Regular Reviews: Quarterly access reviews and certification
3.3 Data Segregation
Personal data is logically segregated to minimize exposure:
- Helper and employer data stored in separate database schemas
- Communication data isolated from profile information
- Payment information processed by separate, certified systems
- Testing environments use anonymized, non-production data
4. Monitoring & Detection
4.1 24/7 Security Monitoring
Our security operations center provides round-the-clock monitoring:
Real-Time Threat Detection
- Automated detection of suspicious login patterns
- Malware and virus scanning of all uploads
- Behavioral analysis for anomalous user activity
- Geographic anomaly detection for access patterns
Alert Systems
- Immediate alerts for security incidents
- Automated response to common threats
- Integration with security information and event management (SIEM)
- Real-time dashboard for security status
Audit Logging
- Comprehensive logs of all data access
- Immutable audit trails for compliance
- Retention of logs for 7 years minimum
- Regular log analysis and correlation
4.2 Incident Response
We maintain a comprehensive incident response plan:
1. Detection & Analysis
Immediate identification and classification of security incidents
2. Containment
Isolation of affected systems to prevent further damage
3. Eradication
Removal of threats and vulnerability patching
4. Recovery
System restoration and enhanced monitoring
5. Lessons Learned
Post-incident analysis and security improvements
5. Data Storage & Infrastructure
5.1 Secure Cloud Infrastructure
Our data is stored in world-class, secure data centers:
Cloud Provider Security
- SOC 2 Type II certified data centers
- ISO 27001 and 27017 compliance
- Physical security with 24/7 monitoring
- Geographic redundancy across multiple regions
Data Center Features
- Biometric access controls
- Redundant power and cooling systems
- Fire suppression and environmental controls
- Multiple network connections and failover
5.2 Data Backup & Recovery
Comprehensive backup and disaster recovery procedures:
- Automated Backups: Continuous data backup with point-in-time recovery
- Geographic Distribution: Backups stored in multiple geographic locations
- Recovery Testing: Monthly disaster recovery drills
- RTO/RPO Objectives: Recovery time under 4 hours, data loss under 1 hour
5.3 Data Retention & Deletion
We follow strict data retention and deletion policies:
Active User Data
Retained while account is active and for 7 years after closure
Communication Logs
Stored for 3 years for customer service and security purposes
Audit Logs
Maintained for 7 years for compliance and security analysis
Marketing Data
Retained until consent withdrawal or 2 years, whichever is earlier
6. Regulatory Compliance
6.1 Hong Kong Data Protection Compliance
Full compliance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486):
- Data Protection Principles: All six principles fully implemented
- Consent Mechanisms: Clear opt-in processes for data processing
- Access Rights: User access and correction rights supported
- Breach Notification: Mandatory reporting to PCPD and affected individuals
6.2 International Standards
Adherence to international data protection frameworks:
GDPR Alignment
European data protection principles and user rights
APPI Compliance
Japanese Act on Protection of Personal Information standards
PIPEDA Alignment
Canadian Personal Information Protection and Electronic Documents Act
6.3 Industry-Specific Requirements
Compliance with relevant industry standards:
- Payment Card Industry (PCI DSS): Secure handling of payment data
- Financial Institution Standards: Banking-level security for financial data
- Healthcare Privacy: HIPAA-aligned protections for health-related information
- Employment Data: Compliance with labor law data protection requirements
7. Data Breach Response
7.1 Incident Classification
We classify security incidents by severity to ensure appropriate response:
Critical (Level 1)
Large-scale data breach affecting thousands of users
Response: 1 hour
High (Level 2)
Significant breach affecting hundreds of users
Response: 4 hours
Medium (Level 3)
Limited breach affecting individual users
Response: 24 hours
Low (Level 4)
Minor incident with minimal data exposure
Response: 72 hours
7.2 Notification Procedures
In case of a data breach, we follow strict notification protocols:
Internal Response (0-1 hours)
- Immediate security team activation
- Incident containment and assessment
- Executive leadership notification
- Legal and compliance team involvement
Regulatory Notification (24-72 hours)
- PCPD notification as required by law
- Relevant international data protection authorities
- Law enforcement if criminal activity suspected
- Industry security organizations
User Communication (72 hours)
- Direct notification to affected users
- Clear explanation of the incident
- Specific steps users should take
- Enhanced security recommendations
User Protection Measures
In the event of a breach, we provide free credit monitoring services, identity theft protection,
and dedicated support to affected users.
8. Your Data Protection Controls
8.1 Account Security Features
Take control of your account security with these features:
Two-Factor Authentication
Add an extra layer of security with SMS or app-based 2FA
Security Dashboard
View login history, active sessions, and security settings
Data Download
Export your personal data in a portable format
Account Deletion
Permanently delete your account and all associated data
8.2 Privacy Settings
Customize your privacy preferences:
- Profile Visibility: Control who can see your profile information
- Communication Preferences: Manage email and notification settings
- Data Sharing: Opt-in or opt-out of data sharing for service improvement
- Marketing Communications: Unsubscribe from promotional emails
8.3 Regular Security Checkups
We recommend regular security maintenance:
9. Third-Party Data Protection
9.1 Vendor Security Assessment
All third-party vendors undergo rigorous security evaluation:
- Security Questionnaires: Comprehensive assessment of vendor security practices
- Compliance Verification: Confirmation of relevant certifications and standards
- Contractual Protections: Data processing agreements with strict security
requirements
- Regular Audits: Ongoing monitoring and reassessment of vendor security
9.2 Payment Processing Security
Financial transactions are processed by certified payment providers:
PCI DSS Certified
Payment Card Industry Data Security Standard compliance
Tokenization
Sensitive payment data replaced with secure tokens
Fraud Protection
Advanced fraud detection and prevention systems
9.3 Cloud Service Providers
Our cloud infrastructure providers maintain the highest security standards:
- Major Cloud Providers: AWS, Microsoft Azure, Google Cloud Platform
- Security Certifications: SOC 2, ISO 27001, and regional compliance
- Data Residency: Geographic control over data storage locations
- Shared Responsibility: Clear division of security responsibilities