PDP Compliance
This page explains the division of roles under the Personal Data Protection Law (UU PDP, Law No. 27 of 2022), the security controls that run in Diginov, and how your business handles customer requests about their data. Its content follows the compliance evidence pack as of 29 October 2026.
Note that this page is not a legal opinion. Diginov does not claim full compliance with UU PDP. Diginov does not yet have a security certification or an independent audit report.
Roles of your business and the platform
For the customer data that you manage through messaging channels (WhatsApp, Telegram, Instagram, and Web Widget), your business is the personal data controller and Diginov is the personal data processor. Diginov processes that customer data only on the instructions of your business. This division of roles is written in the Privacy Policy and section 3 of the Terms of Service, or in the service agreement that applies to your business.
For dashboard user account data (name, email address, and sign-in identifier) and billing data, Diginov is the controller.
As the controller, your business determines the basis for processing customer data. Diginov does not record customer consent, so your business manages consent outside Diginov.
Security controls in operation
The following controls are active in the production system as of 29 October 2026:
- User passwords are stored with bcrypt.
- WhatsApp, Instagram, and Telegram channel tokens are encrypted in the database.
- The broadcast sending queue is encrypted with your business's own data key, which is wrapped by a master key.
- The application's connections to the database and database replication use TLS 1.3.
- Daily database backups are encrypted.
- Every data query is limited to the business that owns the data.
- User access rights follow three roles: Admin, Supervisor, and Agent. The details are in the User roles topic.
- Two-step verification is available as an option for business users. How to turn it on is in the Account and security topic.
- Accounts are locked after repeated failed sign-in attempts, and IP addresses that repeat those attempts are blocked automatically.
- Security events, for example failed sign-in attempts, are recorded and kept for 90 days.
- Data is stored in a data center in Indonesia and replicated to a disaster recovery center that is also in Indonesia.
This list includes only controls with the status Berjalan (running). Application-level encryption does not cover all data yet. The limits of each control and the items not yet met are explained in the Claim limits, gaps, and roadmap document in the PDP Compliance menu.
Other parties that also process data
WhatsApp and Instagram messages pass through Meta's infrastructure, and Telegram messages pass through Telegram's infrastructure, depending on the channels you use. A cloud AI model provider also processes data only if you turn on an AI feature and choose a cloud provider. You can turn off the AI features per channel, and a channel without AI does not send data to an AI model provider. The list of other parties is in the Privacy Policy.
Handle customer requests about their data
Customers have no self-service page to request their data. A customer sends the request to your business, and your team handles it in the dashboard.
| Customer request | How to handle it |
|---|---|
| View or correct data | Open the customer profile in Chat Settings > Customers. The conversation history is in Chat. |
| A copy of the data | Create a chat transcript report with the customer filter in Business Settings > Reports (Admin or Supervisor, if the analytics feature is active). How to do this is in the Reports and exports topic. |
| Data deletion | An Admin submits a deletion request in Chat Settings > Deletion Requests. The steps are in the Customers topic. |
The platform operator executes the deletion, with a target of completion within 3×24 hours after the request is submitted. This deletion does not delete all data. Message history, numbers in delivery records, and billing records are kept as audit evidence until the retention period ends, and are then deleted permanently. The default retention period is 120 months.
Incident notification
If an incident affects the data of your business, Diginov notifies the admin of your business according to section 9 of the Terms of Service. Notifying customers and the competent authorities, including OJK if OJK supervises your business, remains the obligation of your business as the controller.
Open the evidence pack for auditors
In the Help > PDP Compliance menu, Admins open the compliance evidence pack for the auditors of your business. This menu appears only for Admins, and only if the PDP Compliance feature is active for your business.
- Open Help > PDP Compliance.
- In the document list, click the title of the document you want to open, for example PDP Law summary and matrix. The first document appears when the menu opens.
- Click Print / Save as PDF. The browser print window opens. Select a printer, or select Save as PDF.
The pack contains four documents, available in Indonesian only:
- PDP Law summary and matrix: the obligations per article, the controls, their status, and their claim limits.
- IT service provider questionnaire answers (OJK): answers to questions that financial services institutions commonly ask.
- Technical security and encryption evidence: details of the security controls above.
- Claim limits, gaps, and roadmap: what does not exist yet or exists only in part, with the plan for each.
The content of the pack is confidential and is prepared for the auditors of your business. Each time this menu is opened, the system records it as a security event.