Skip to content
Puccha Puccha KM

Security and compliance

Updated 2026-09-21 · owner Puccha team · security pdpa compliance audit iso27001

Puccha is built for Thai enterprises under supervision — PDPA, the Bank of Thailand (BOT), the SEC and the OIC — on an audit-ready-by-design principle: every feature maps to a named regulatory control.

Controls that are live today

Section titled “Controls that are live today”
  • Tenant isolation — every query is scoped by tenant_id; data cannot cross organisations.
  • PDPA: raw question text is never stored in logs — it is hashed. Conversation retention is configurable per plan.
  • Data subject rights (PDPA §33) — export and erasure APIs exist at both the organisation and the individual visitor level.
  • Admin access is audit-logged — and visible to the data subject.
  • API keys are hashed (SHA-256), never stored in plaintext.
  • Prompt-injection defence — user input is sanitised, attack patterns are rejected, the system prompt is never echoed, and retrieved content is explicitly marked as untrusted reference material.
  • Citations are validated server-side against the chunks actually retrieved.
  • MFA for agents — TOTP + recovery codes, with step-up on high-impact actions.
  • Layered rate limiting — at the edge, per session, per-organisation quota, and a cost cap at the AI gateway.

In progress

Section titled “In progress”
  • ISO 27001 — in preparation and audit. The Statement of Applicability is available to buyers on request, under NDA.
  • SOC 2 Type II — observation window started.
  • Data residency — options to pin processing to a region (Enterprise).
  • Compliance deliverables (DPA + SCC + DPO consultation) for enterprise customers.

Not yet certified. ISO 27001 and SOC 2 are in progress, not awarded. Current status is published in the trust center.

DPA and cross-border transfers

Section titled “DPA and cross-border transfers”

For cross-border transfers (PDPA §28/29) Puccha provides SCC-based Appropriate Safeguards with a Thai overlay, including 72-hour breach notification, covering data flows to AI processors.

Frequently asked questions

Section titled “Frequently asked questions”

What security controls are live today? The controls live now are tenant isolation, so data cannot cross organisations; logs that store a hash rather than the raw question text; export and erasure APIs for data subject rights (PDPA §33) at both the organisation and the visitor level; audit-logged admin access that the data subject can see; API keys hashed with SHA-256; prompt-injection defence; server-side validation of every citation against the chunks actually retrieved; MFA for agents; and layered rate limiting. ISO 27001 and SOC 2 are in progress, not yet certified — see “In progress” above.