Security, compliance, and integrity — engineered into every transaction

Twala is a legal technology platform purpose-built to support the digital execution, notarization, and intelligent processing of documents at enterprise scale. Trust is not a feature we bolt on; it is embedded into our architecture, our operational processes, and our organizational governance. This Trust Center outlines the principles, controls, and commitments that underpin the Twala platform.

Our Approach to Security

Security at Twala is governed by a defense-in-depth philosophy, layering technical controls, organizational policies, and continuous oversight to protect the confidentiality, integrity, and availability of every document and data point that passes through our platform. Our security program is designed to meet the expectations of regulated industries, including banking, financial services, real estate, and government institutions.

Data Protection & Privacy

Twala is committed to safeguarding personal and business data in full accordance with the Philippines' Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations. Our data protection framework is governed by a formal Privacy Manual that establishes clear policies for the collection, processing, storage, retention, and disposal of personal data, overseen by our designated Data Protection Officer.

We adhere to the principles of data minimization and purpose limitation, ensuring that only data necessary for service delivery is collected and processed. Data subject rights, including access, correction, and erasure requests, are supported through documented internal procedures.

Infrastructure & Resilience

Twala's platform operates on secure, enterprise-grade cloud infrastructure engineered for high availability and operational resilience. Our infrastructure strategy incorporates a formal Disaster Recovery Plan and Business Continuity Plan, designed to maintain service continuity and safeguard data integrity in the event of unplanned disruptions. Recovery mechanisms span multiple geographic regions to minimize downtime and support business-critical operations for our enterprise clients.

Encryption

All documents and data processed on the Twala platform are encrypted both at rest and in transit, using industry-standard encryption protocols. This ensures that sensitive information remains protected at every stage of its lifecycle — whether stored within our systems or transmitted between parties.

Document Integrity & Cryptographic Authentication

Every document signed or notarized through Twala is cryptographically anchored using blockchain technology combined with Public Key Infrastructure (PKI). This dual-layer approach provides immutable, tamper-evident proof of document authenticity and execution history, ensuring that any unauthorized alteration is immediately detectable and independently verifiable.

Identity Verification & Signatory Assurance

Twala employs a multi-layered identity verification framework to ensure signatory authenticity. This includes verification of email addresses and mobile numbers, as well as artificial intelligence-enabled identity verification requiring a government-issued ID and a live selfie. These controls are designed to establish a high degree of confidence in signatory identity for every transaction.

Access Control & Enterprise Administration

Enterprise clients benefit from centralized access control through single sign-on (SSO) integration, alongside granular, role-based permission structures that govern who may view, sign, manage, or administer documents within their organization. These controls support enterprise governance requirements and enable organizations to enforce internal policies at scale.

Monitoring, Detection & Incident Response

Twala maintains continuous, real-time security monitoring across its infrastructure to detect, investigate, and respond to potential threats. This is supported by documented incident response procedures designed to ensure timely containment, remediation, and communication in the event of a security incident.

Legal & Regulatory Compliance

Twala's platform is architected around, and designed to comply with, the following legal and regulatory frameworks:

• Republic Act No. 8792 — Electronic Commerce Act
• Republic Act No. 10173 — Data Privacy Act of 2012
• A.M. No. 01-7-01-SC — Rules on Electronic Evidence
• A.M. No. 24-10-14-SC — Rules on Electronic Notarization

Twala's eSignature and eNotarization solutions are additionally designed with alignment to internationally recognized e-signature principles, supporting enforceability across many major jurisdictions.

Certifications & Governance Frameworks

Twala is actively working toward ISO/IEC 27001 certification, the internationally recognized standard for information security management systems. This initiative reflects our long-term commitment to formalized governance, risk management, and continuous improvement of our security posture, and is supported by an internal Information Security Management System (ISMS) framework already in place across the organization.

Organizational Commitment to Trust

Beyond technical safeguards, Twala maintains internal governance instruments — including an Employee Handbook and a Code of Conduct — that establish organization-wide standards for data handling, confidentiality, and ethical conduct. These policies ensure that trust and security are upheld not only at the platform level, but throughout the organization.

Questions or Inquiries

For questions regarding security, privacy, or data protection, including formal data subject requests, please contact our Data Protection Officer at dpo@twala.io.