Security & Compliance

This page explains how PT Ikara Digital Nusantara ("IKARA") protects its systems and client data. It applies to all IKARA products and services: the ikara.id website, IKARA Console, every IKARA subscription application (including IKARA Samaya and future products), and custom systems built and operated by IKARA on our servers.

Summary

Infrastructure

• Applications run on a hosting provider's servers in a data center in Indonesia. Server access is limited to authorized IKARA technical staff over encrypted connections.
• Every page is served over HTTPS only. Browsers are instructed to always use a secure connection (HSTS), and every page sends security headers that prevent clickjacking, script injection, and referrer leakage.
• Sign-in attempts, form submissions, and API access are rate-limited to resist password guessing and abuse.

Client data isolation

• Every subscription client has its own database, its own application encryption key, and its own file storage, even though they share the same application code.
• This isolation is tested automatically on every update: one client's data, files, sessions, and caches must never be readable by another client.
• Within an organization, data is further limited by each user's role and work unit.

Access & accounts

• Passwords are at least 10 characters and stored only as hashes, never in plain text.
• Two-factor authentication (authenticator app) is mandatory for top-level administrators and billing managers.
• Accounts are temporarily locked after repeated failed sign-ins. Account owners receive alerts when signing in from a new device and can end sessions on other devices.
• Access rights follow roles (e.g. Super Admin, Admin, Staff, Executive); every action is checked on the server, not merely hidden in the interface.
• IKARA staff access to IKARA Console also requires two-factor authentication and role-based permissions.

Encryption & secrets

• Data is transmitted over encrypted connections (TLS).
• Keys, tokens, and integration secrets are stored encrypted or only in server configuration files that are not publicly accessible; tokens that only need to be matched are stored as hashes.
• User sessions are encrypted. Secrets are rotated periodically and immediately when a leak is suspected.

Backup & recovery

• Each client's database is backed up daily on the server.
• Backup copies are encrypted with AES-256 before leaving the server; only IKARA holds the key. Copies are stored with a trusted cloud storage service (whose data centers may be outside Indonesia) and, when enabled, in a domestic data center.
• The disaster recovery procedure is documented and tested, so services can be restored to another server when needed.
• Clients can download all of their data at any time from the application's Settings menu.

Audit trail

• Sign-ins, sign-outs, failed sign-ins, data changes, exports, and settings changes are recorded in an activity log that cannot be altered or deleted from the application.
• The IKARA Console log is hash-chained, so changes made outside the application can be detected.

Artificial intelligence (AI)

• AI features are only active when included in the client's plan. Requests go through the IKARA Console gateway, not directly from client applications.
• Personal names, partner organization names, and document numbers are pseudonymized before being sent to the AI provider and restored after the answer is received. Full document contents are only sent when the organization's administrator allows it.
• The AI provider is accessed through a commercial API service that does not use the data to train models. Copies of AI requests in IKARA systems are deleted within 30 days.

Payments

Online payments are processed by a payment gateway licensed by Bank Indonesia. IKARA does not receive or store payment card data.

Secure development

• Every update goes through static code analysis, automated tests (including access-control and data-isolation tests), and vulnerability checks on third-party libraries before deployment.
• Client data is never used on developer machines; testing uses sample data.
• Every change is recorded in version history and release notes.

Personal data protection

• Personal data processing follows Indonesian Law No. 27 of 2022 on Personal Data Protection; details are in our Privacy Policy.
• IKARA acts as a data processor for the data clients enter into the application, and provides a data processing agreement and handover report for every service.
• After a subscription ends, data can be exported during the retention period, then deleted and recorded in a deletion report.

Incident handling

If a personal data protection failure occurs, IKARA contains and handles the incident, notifies affected clients, and delivers written notice no later than 3 × 24 hours as required by Indonesian data protection law, describing the affected data, when and how it happened, and the handling and recovery steps.

Systems on client-owned servers

For custom systems installed on servers or data centers owned by the client, infrastructure security follows the client's environment. IKARA still applies the same development, testing, and application configuration practices described on this page.

Reporting a security issue

If you find a security vulnerability in an IKARA system, report it to info@ikara.id with the subject "Security report". Please do not access other parties' data and do not disclose the issue publicly before we fix it. We respond to reports on business days.

The Indonesian version is the governing version.