Security & compliance
How we approach security, data protection and deployment — stated plainly, so you know exactly what applies to your engagement.
Security, sovereignty and compliance capabilities vary by product and deployment tier and are subject to your agreement with us. Current certifications are listed below.
Certifications
We believe in being precise about our posture. As of 23 July 2026, CWG Innovations does not hold formal security certifications. We are actively working towards SOC 2 and the Cyber Security Agency of Singapore (CSA) Cyber Essentials mark. We will update this page as certifications are achieved, and we do not describe ourselves as “certified” for anything we have not yet earned.
Hosting & data location
Our corporate systems are hosted in Singapore and the United States. Where personal data is processed outside Singapore, we take the steps required under section 26 of the PDPA so the recipient provides a comparable standard of protection. See our Privacy Policy for details on data handling and cookies.
Deployment options
Our solutions are available across selected deployment tiers, so security and data-residency characteristics can be matched to your requirements:
- Sovereign-ready cloud — with data-residency options designed to support procurement and regulatory review.
- On-premise and air-gapped — deployed within your own environment, with customer-managed keys.
- In on-premise and air-gapped deployments, the system runs open models locally with no outbound telemetry. This does not apply to the public multi-model cloud, which routes to third-party model providers.
Safeguards
We maintain reasonable administrative, technical and physical safeguards appropriate to the data we handle, in line with section 24 of the PDPA, including:
- encryption of data in transit (HTTPS/TLS);
- access control on a need-to-know basis;
- logging and monitoring of our systems; and
- governance and data-protection practices overseen by our Data Protection Officer.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Data protection & your rights
How we collect, use and protect personal data — and how to access, correct or delete your data or withdraw consent — is set out in our Privacy Policy. For any data-protection enquiry, contact our Data Protection Officer at dpo@cwgsg.ai.
Frequently asked questions
Is CWG Innovations PDPA-compliant?
We are committed to the PDPA, have appointed a Data Protection Officer (dpo@cwgsg.ai), and maintain policies and safeguards accordingly.
Where is data hosted?
Our systems are hosted in Singapore and the United States; deployment options include sovereign-ready cloud, on-premise and air-gapped tiers.
Do you sell my data?
No.
What certifications do you hold?
None yet — we are working towards SOC 2 and the CSA Cyber Essentials mark.
How do I access, correct or delete my data, or withdraw consent?
Email dpo@cwgsg.ai; we respond within the timeframes required by the PDPA.
Does this website use my data to train AI?
No. The RealRelay product’s data handling is described in its own documentation.