Skip to content
Trust Center

Security, privacy and compliance at Bakasir

Businesses entrust Bakasir with their sales, stock and customer records. This page explains how we protect that information and the standards we hold ourselves to.

Standards and regulations

Bakasir maintains compliance with the following international and Indonesian frameworks.

PCI DSS

Payment Card Industry Data Security Standard

Bakasir does not store, process or transmit full card numbers. Card and e-wallet payments are completed on the hosted pages of PCI DSS certified payment providers, which keeps cardholder data out of Bakasir systems.

  • Card details are entered only on the payment provider's pages
  • Bakasir stores payment status and references, never card numbers
  • Provider notifications are verified by signature before an order is marked paid

GDPR

General Data Protection Regulation (EU) 2016/679

For people in the European Economic Area, Bakasir processes personal data lawfully, fairly and transparently, for specified purposes, and supports every data subject right.

  • Rights of access, rectification, erasure, restriction, portability and objection
  • Processor terms for the customer data merchants collect
  • Safeguards such as Standard Contractual Clauses for international transfers
  • Consent before any non essential cookie

CCPA / CPRA

California Consumer Privacy Act, as amended by the California Privacy Rights Act

Bakasir does not sell personal information or share it for cross context behavioural advertising, and honours the privacy rights of California residents.

  • Rights to know, delete, correct and limit use
  • Global Privacy Control and Do Not Track signals are treated as an opt out
  • No discrimination for exercising privacy rights

UU PDP

Indonesian Personal Data Protection Law (Law No. 27 of 2022)

Bakasir is the data controller for account data and a data processor for the customer data that merchants collect, with a designated data protection officer and documented processing activities.

  • Notification of a personal data breach within 3 x 24 hours
  • Safeguards for transfers of personal data outside Indonesia
  • Requests from data subjects handled within the statutory period

ISO/IEC 27001

Information security management systems

Bakasir operates an information security management system covering risk assessment, access control, secure development, change management, incident response and supplier management.

  • Least privilege access for staff and systems
  • Security reviewed in every release
  • Incident response and vulnerability disclosure procedures

ISO/IEC 27701

Privacy information management systems

Our privacy information management system extends ISO/IEC 27001 with controls for both controller and processor roles.

  • Records of processing and privacy by design
  • Data minimisation and defined retention schedules
  • Structured handling of data subject requests

Security controls in the platform

Protection built into every edition of Bakasir, with no extra configuration.

  • Tenant isolationEach business's data is logically separated at the database level, so one business can never access another's records.
  • Strong authenticationPasswords are protected with modern one way hashing, and accounts can be secured with two factor authentication and passkeys.
  • Role based accessOwners decide what Managers and Staff may view or change, down to individual actions such as discounts, voids and refunds.
  • Approval for sensitive actionsDiscounts, voids and refunds by staff require a Manager or Owner PIN or a remote approval, and every decision is recorded.
  • Encrypted connectionsAll traffic to Bakasir websites, apps and the API is encrypted in transit with TLS.
  • Device pairingDesktop and Android cashier devices are paired with single use codes and can be locked or unpaired remotely.
  • Payment data kept outCard numbers never reach Bakasir; payments are completed on the pages of certified payment providers.
  • Data portability and deletionMerchants can export their data at any time. After an account closes, data remains exportable for 30 days and is permanently deleted within 90 days.

Third party service providers

We engage carefully selected providers, bound by written data protection and confidentiality obligations, to deliver the service. Merchants may request the current detailed list in writing.

CategoryPurposeProcessing location
Cloud infrastructure and hostingRunning the application, databases and file storageWithin or outside Indonesia
Network and security servicesContent delivery, DNS and protection against attacksWithin or outside Indonesia
Payment processorsProcessing subscription and online store paymentsWithin or outside Indonesia
Authentication providersOptional sign in with a third party accountWithin or outside Indonesia
AI service providersAnswering questions in the documentation assistantWithin or outside Indonesia
Communication servicesSending service emails and notificationsWithin or outside Indonesia

Legal documents

Certificates and security reviews

Customers and prospective customers can request certificates, audit summaries and our data processing terms. Researchers can report a suspected vulnerability through our disclosure program.

Contact usReport a vulnerability
Bakasir

Let’s get to work.

Choose your business type and prepare your first store.

Set up your store