“The controls below are product controls, not a claim of certification. The Cyber Essentials certificate and the independent penetration test are separate, and each is stated here with its own scope and dates. The penetration test covered keelsg.com as it stood on those dates, before the order features were added.”
Checked from the outside.
One certification and one penetration test, each with its scope and its dates.
Cyber Essentials certified (ICT Vendor)
Issued by ISOCert Pte Ltd under the CSA Cybersecurity Certification, Cyber Essentials (2025) for ICT Vendors. The certificate applies to the scope stated here and to nothing wider.
- Certificate number
- CEM-2026-261
- Certified organisation
- NICKTUNG
- Issued by
- ISOCert Pte Ltd
- Originally issued
- Valid
- to
- Scope
- The production and development environment of the ICT vendor for the service.
Independent penetration test of keelsg.com
Findings by severity Critical High Medium Low 0 0 0 1 One Low-severity finding (HSTS not enforced). No Critical, High or Medium findings. A retest on confirmed it fixed and closed.
The test covered keelsg.com as it stood on those dates, before the Orders module was added. It does not cover it.
- Test
- Web application vulnerability assessment and penetration test
- Target
- https://keelsg.com
- Tested by
- Avotis Security Pte Ltd, a CREST-accredited firm
- Dates
- 25 to 27 September 2026
- Approach
- Grey-box (with credentials) plus black-box
- Retest
- Retest confirmed the finding fixed and closed.
6 things.
And what each one is for.
Organisation and row-level isolation
A salesperson with owner-only access who types a colleague's record ID into the address bar is denied at the server, not shown an empty page that still loaded the record. The same boundary separates one company on the system from another: a known record ID from another organisation returns nothing, not a near miss.
Benefit A hidden button is never the security boundary.
Proof: Organisation scope · row-level security · cross-tenant tests
Roles, teams and permissions
Role, team, business-unit and resource scopes apply to reads and to actions, and sensitive workflows are checked on the server rather than in the browser.
Benefit People reach only what their job requires.
Proof: Roles · teams · resource scopes · server-side enforcement
A recorded reason for every personal data field
When a field or a capture source is configured, its purpose, its lawful or operational basis, its sensitivity, its retention class and who can see it are all recorded together in a catalogue.
Benefit It is the document you will want on the day somebody asks what personal data you hold and why.
Proof: Purpose · basis · sensitivity · retention class · visibility
Audit and provenance
Administrative changes, AI actions, exports, deletions, sign-ins and integration activity each write an append-only audit event: who did it, what they did, what it touched, whether it succeeded and when. The event records the action without storing the personal data or any secret inside it.
Benefit An administrator can reconstruct what changed, who started it and how it ended.
Proof: Actor · action · resource · outcome · correlation · append-only
Retention and hard deletion
Retention classes, and the delete or anonymise action attached to each, are configured with you during setup rather than fixed by us. When a hard deletion runs against an approved request with no legal hold, the records, the generated files and the searchable copies go, and the receipt proves it without reprinting what was deleted.
Benefit Data leaves through a deliberate process, not just off a screen.
Proof: Retention classes · legal hold · hard deletion · receipt · residue checks
Fail-closed AI and integrations
Missing configuration stops the action rather than quietly weakening the control. Provider readiness, permission-filtered context and a human approval are all required before anything sensitive reaches the outside world.
Benefit The failure mode is a stop, not a silent downgrade.
Proof: Readiness check · permission filter · human gate · terminal failure
Four steps, in this order, every time.
- 01
Authenticate
Establish the user and the organisation.
- 02
Authorise
Check role, team, resource and action scope first.
- 03
Execute
Run the bounded operation at the database boundary.
- 04
Evidence
Write the outcome without writing the secret.
Thirty minutes, and you leave with three answers.
Whether a pilot fits the way your orders arrive, what we would set up, and what it would cost. Written down, so you can put it in front of a partner or a board.
Bring three things
- A few real orders, as they arrive today.
- Your product and price list, in whatever form it is in.
- Who takes and confirms orders now.
Leave with three answers
- Whether the pilot fits.
- What we would set up, and how.
- What it would cost, written down.