Security, compliance, and integrity, engineered into every transaction

Security at Twala is governed by a defense-in-depth philosophy, layering technical controls, organizational policies, and continuous oversight to protect the confidentiality, integrity, and availability of every document and data point that passes through our platform. Our security program is designed to meet the expectations of regulated industries, including banking, financial services, real estate, and government institutions.

Twala is committed to safeguarding personal and business data in full accordance with the Philippines' Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations. Our data protection framework is governed by a formal Privacy Manual that establishes clear policies for the collection, processing, storage, retention, and disposal of personal data, overseen by our designated Data Protection Officer.

We adhere to the principles of data minimization and purpose limitation, ensuring that only data necessary for service delivery is collected and processed. Data subject rights, including access, correction, and erasure requests, are supported through documented internal procedures.

Twala's platform runs on Amazon Web Services in the Asia Pacific (Singapore) region, engineered for high availability and operational resilience. Its database is deployed across multiple availability zones, with a standby kept in sync, and failed background jobs are retried automatically. Our infrastructure strategy incorporates a formal Disaster Recovery Plan and Business Continuity Plan, designed to maintain service continuity and safeguard data integrity in the event of unplanned disruptions.

Every connection to Twala uses HTTPS, and the services behind it connect over TLS. Sensitive fields, such as bank details, are encrypted by the application before they are stored, with keys kept separate from session secrets.

Every document Twala seals, whether signed, timestamped, or notarized, carries the Twala Platform Seal: a digital signature made with Twala’s X.509 certificate over the finished PDF. Twala then records the sealed file’s SHA-256 hash and anchors it on the Polygon blockchain in a batch, every 15 minutes. This dual-layer approach gives tamper-evident proof of the document’s exact form, so any unauthorized alteration is detectable and independently verifiable.

Twala employs a multi-layered identity verification framework to ensure signatory authenticity. This includes verification of email addresses, as well as artificial intelligence-enabled identity verification requiring a government-issued ID and a live selfie. These controls are designed to establish a high degree of confidence in signatory identity for every transaction.

Enterprise clients benefit from centralized access control through single sign-on (SSO) integration, alongside granular, role-based permission structures that govern who may view, sign, manage, or administer documents within their organization. These controls support enterprise governance requirements and enable organizations to enforce internal policies at scale.

Twala maintains continuous, real-time security monitoring across its infrastructure to detect, investigate, and respond to potential threats. This is supported by documented incident response procedures designed to ensure timely containment, remediation, and communication in the event of a security incident.

Twala's platform is architected around, and designed to comply with, the following legal and regulatory frameworks:

• Electronic Commerce ActRepublic Act No. 8792
• Data Privacy Act of 2012Republic Act No. 10173
• Rules on Electronic EvidenceA.M. No. 01-7-01-SC
• Rules on Electronic NotarizationA.M. No. 24-10-14-SC

Twala's eSignature and eNotarization solutions are additionally designed with alignment to internationally recognized eSignature principles, supporting enforceability across many major jurisdictions.

Twala is actively working toward ISO/IEC 27001 certification, the internationally recognized standard for information security management systems. This initiative reflects our long-term commitment to formalized governance, risk management, and continuous improvement of our security posture, and is supported by an internal Information Security Management System (ISMS) framework already in place across the organization.

• ISO/IEC 27001Actively working toward certificationIn progress
• Information Security Management System (ISMS)Internal framework already in place across the organizationIn place

Beyond technical safeguards, Twala maintains internal governance instruments, including an Employee Handbook and a Code of Conduct, that establish organization-wide standards for data handling, confidentiality, and ethical conduct. These policies ensure that trust and security are upheld not only at the platform level, but throughout the organization.

For questions regarding security, privacy, or data protection, including formal data subject requests, contact our Data Protection Officer.