Security
Your money. Your data. Protected.
We built Sampul with the same security standards you expect from a financial institution — verified identity when you join, encryption throughout, and read-only bank connections. We'd rather show you how than shout about it.
Double-locked vault
Encryption at rest and in transit — your data stays sealed.
Read-only keys
Bank connections can see balances — never move your money.
Verified when you join
Government ID, live face match, and fraud checks — so the account opening the door is really yours.
Hardened cloud
Enterprise infrastructure with monitoring and backups.
Encryption
Your data is encrypted in transit using TLS and encrypted at rest on our infrastructure. Sessions are secured and expire automatically after inactivity, so a forgotten open tab doesn't become a risk.
Identity verification
When you create your Sampul account, we confirm it's really you — not someone with a stolen photo or a copied ID. You scan your MyKad or passport, take a quick live face check, and we match your face to your document in seconds.
Behind that simple flow: document authenticity checks, passive liveness to catch spoofing and deepfakes, device and duplicate-account signals, and screening against sanctions and watchlists where regulations require it. Verification data is encrypted, used only to protect your account, and never sold.
Read-only connections
Sampul aggregates your financial data — it does not initiate transfers or payments. Bank connections are read-only by design: there is no capability to move your money, which means there is no such capability to compromise.
Access control
Two-factor authentication protects your login, biometric unlock (Face ID and fingerprint) protects the mobile app, and household permissions control exactly what each family member can see. You decide who sees what, per account and per document.
PDPA compliance
We process personal data in line with Malaysia's Personal Data Protection Act 2010. You can access and export your data, correct it, and delete your account and its data entirely — most of it self-service from Settings, all of it detailed in our Privacy Policy.
Infrastructure
Sampul runs on enterprise-grade cloud infrastructure with managed database security, continuous monitoring, and routine backups. We keep our stack boring where it matters: proven providers, least-privilege access, and audit logging.
Responsible AI
Sampul AI uses your financial data for one purpose: answering your questions and improving your plan. Your data is not sold to third parties, and it is not used to advertise to you.
Incident response
If an incident ever affects your data, we will tell you — clearly, promptly, and with specifics about what happened and what we're doing about it. We maintain an internal incident-response process and notify affected users and regulators as required by law.
Report a vulnerability
Security researchers are welcome. If you believe you've found a vulnerability in Sampul, email security@sampul.app with the details. We read every report, respond quickly, and won't take action against good-faith research.
security@sampul.app →Questions about security?
Read the security articles in our Help Center, or email security@sampul.app.
Sampul is a financial planning platform, not a licensed bank or investment manager, and does not hold or move client money. Investment and estate guidance through our licensed advisor partner network is provided by licensed professionals. Past performance does not guarantee future results. Full legal disclosures →