Security & compliance
How we approach security, data protection and deployment, stated plainly, so you know exactly what applies to your engagement.
Certifications
We believe in being precise about our posture. As of 23 July 2026, CWG Innovations does not hold formal security certifications. We are actively working towards SOC 2 and the Cyber Security Agency of Singapore (CSA) Cyber Essentials mark. We will update this page as certifications are achieved, and we do not describe ourselves as “certified” for anything we have not yet earned.
Hosting & data location
Our corporate systems are hosted in Singapore and the United States. Where personal data is processed outside Singapore, we take the steps required under section 26 of the PDPA so the recipient provides a comparable standard of protection. See our Privacy Policy for details on data handling and cookies.
Deployment options
Our solutions are available across selected deployment tiers, so security and data-residency characteristics can be matched to your requirements:
- Sovereign-ready cloud, with data-residency options designed to support procurement and regulatory review.
- On-premise and air-gapped, deployed within your own environment, with customer-managed keys.
- In on-premise and air-gapped deployments, the system runs open models locally with no outbound telemetry. This does not apply to the public multi-model cloud, which routes to third-party model providers.
Security built into RealRelay.ai
Security is not a separate tool you bolt on to our platform. RealRelay.ai builds validation into the platform itself, so agents are developed and defended in one place:
- a built-in autonomous security-validation agent that continuously tests the agents you build, rather than a one-off review;
- within the scope you authorise, it simulates an attacker’s reasoning to surface real risks, then returns a risk rating, the evidence and remediation guidance;
- once you have remediated, it re-tests, closing the loop from finding a risk to fixing it;
- customers can hold their own keys and connect local models, matching data-control requirements at every tier.
Safeguards
We maintain reasonable administrative, technical and physical safeguards appropriate to the data we handle, in line with section 24 of the PDPA, including:
- encryption of data in transit (HTTPS/TLS);
- access control on a need-to-know basis;
- logging and monitoring of our systems; and
- governance and data-protection practices overseen by our Data Protection Officer.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Data protection & your rights
How we collect, use and protect personal data, and how to access, correct or delete it or withdraw consent, is set out in our Privacy Policy. For any data-protection enquiry, contact our Data Protection Officer at dpo@cwgsg.ai.
Frequently asked questions
Is CWG Innovations PDPA-compliant?
We are committed to the PDPA, have appointed a Data Protection Officer (dpo@cwgsg.ai), and maintain policies and safeguards accordingly.
Where is data hosted?
Our systems are hosted in Singapore and the United States; deployment options include sovereign-ready cloud, on-premise and air-gapped tiers.
Do you sell my data?
No.
What certifications do you hold?
None yet. We are working towards SOC 2 and the CSA Cyber Essentials mark.
How do I access, correct or delete my data, or withdraw consent?
Email dpo@cwgsg.ai; we respond within the timeframes required by the PDPA.
Does this website use my data to train AI?
No. The RealRelay product’s data handling is described in its own documentation.
Does the platform test its own security?
Yes. RealRelay.ai includes an autonomous security-validation agent that continuously tests the agents you build, within the scope you authorise, and returns risk ratings with remediation guidance.