Built for the person asking "is this safe?"
Tenant isolation enforced at the database. Audit log on every access. PDPA-aligned. Freemansland Creatives Pte. Ltd., which operates Decisionlore, holds CSA Cyber Essentials (2025) for ICT Vendors, certificate CEM-2026-256 issued by ISOCert Pte Ltd, valid 1 September 2026 to 31 August 2028.
Technical protection & legal rights.
Where your data lives
Hosted on a managed Postgres database with file storage, in the Singapore region. AES-256 at rest. TLS 1.2+ in transit. No cross-region replication unless you explicitly request it.
Tenant isolation
Every tenant's data is isolated at the database layer via Postgres Row-Level Security. Even if our application code had a bug, the database refuses to return another tenant's data. We run adversarial RLS tests on every deploy.
Authentication
A managed authentication service. JWT-based with HTTP-only cookies. Sign-in via email/password or Google OAuth, with time-based one-time-code (TOTP) two-factor authentication available on every account and required for administrator accounts. Sessions expire on inactivity. Revoke any session from account settings.
Audit logging
Every sign-in, document upload, chat, principle edit, and settings change is logged with actor, timestamp, IP, and metadata. Append-only. Cannot be modified retroactively. Tenant admins query their own audit log. Master admins query everything.
AI usage
We use a managed AI language model provider. Per that provider's policy, your data is not used to train their models. We don't train our own models on your data either. No cross-tenant data sharing.
PDPA compliance
Right of access (export endpoint). Right of deletion (deletion endpoint). Consent withdrawal at any time. Breach notification within 72 hours. DPO reachable at nick@freemanslandcreatives.com.
Every certificate is signed at issuance with a platform Ed25519 key. Every issue and revoke event is appended to a hash-chained internal log, so a silently altered entry breaks the chain and is detectable. Anyone can check a certificate's signature against our published key, independent of trusting this site.
Third parties we use.
Listed in our DPA. Each has its own security posture. We don't add new sub-processors without 30 days' notice.
| category | purpose | region |
|---|---|---|
| Managed database, authentication & storage provider | Stores workspace account records, documents, and application data | Singapore |
| AI language model provider | Generates chat answers, boss-voice calibration, AI-generated training content, and quiz feedback | United States |
| Document embedding provider | Converts uploaded documents into a searchable format so the assistant can find relevant passages | United States |
| Frontend hosting provider | Serves the Decisionlore web application | Singapore |
| Error monitoring provider | Captures technical errors so we can fix bugs quickly, where configured for an environment | Singapore |
Audited, not asserted.
A certification body audits a company, never a piece of software. The certificate below is held by Freemansland Creatives Pte. Ltd., the company that builds and operates Decisionlore, and it covers the production and development environment this product is built and run in.
Freemansland Creatives Pte. Ltd. (UEN 202321157G) is certified under the CSA Cybersecurity Certification, Cyber Essentials mark for ICT Vendors (certificate CEM-2026-256, valid 1 September 2026 to 31 August 2028), issued by ISOCert Pte Ltd.
- certificate no.
- CEM-2026-256
- standard
- CSA Cybersecurity Certification, Cyber Essentials (2025), for ICT Vendors
- certified entity
- Freemansland Creatives Pte. Ltd.
- scope
- The production and development environment of the ICT vendor for the service
- certification body
- ISOCert Pte Ltd
- valid
- 1 September 2026 to 31 August 2028
We do not republish the certificate document itself. It remains the property of ISOCert Pte Ltd and may not be reproduced without their written permission, so every value printed on it is stated above as text you can check against the copy the certification body holds.
One held. Three ahead.
The first card is a certificate the company actually holds, and the section above lists every value on it. The other three are intentions. No target date is published for any of them, because we would rather say nothing than publish a date we invented, and we will update this page as each one actually lands.
Cyber Essentials for ICT Vendors
Certificate CEM-2026-256, 1 September 2026 to 31 August 2028. Held by Freemansland Creatives Pte. Ltd.
Cyber Trust (Promoter, Tier 3)
Intended, with no target date published.
DPTM (Data Protection Trustmark)
Intended, with no target date published.
ISO 27001
Intended, with no target date published.
Common security questions.
Everything you need to know about data handling, host isolation, and security certifications.
Is this AI training platform PDPA compliant?
Decisionlore is built PDPA-aligned: right of access via an export endpoint, right of deletion via a deletion endpoint, consent withdrawal at any time, breach notification within 72 hours, and a named DPO. On external certification: Freemansland Creatives Pte. Ltd., the company that operates Decisionlore, is certified under the CSA Cybersecurity Certification, Cyber Essentials mark for ICT Vendors, certificate CEM-2026-256, issued by ISOCert Pte Ltd and valid from 1 September 2026 to 31 August 2028. That certification is held by the company, not by the software. We hold neither DPTM nor ISO 27001 today.
Where is my data hosted? Is there Singapore data residency for this AI software?
Yes for the core platform: your account records, documents, and application data sit on a managed Postgres database with file storage in the Singapore region, AES-256 at rest, TLS 1.2+ in transit. Two sub-processors process data outside Singapore to do their specific job: the AI language model provider and the document embedding provider, both currently United States-based. See the sub-processors table above for the full list.
Is my company's data isolated from other companies on the platform?
Yes. Every tenant's data is isolated at the database layer using Postgres Row-Level Security, so even a bug in our application code can't return another tenant's data. We run adversarial RLS tests on every deploy.
Are you Cyber Essentials, DPTM, or ISO 27001 certified?
Cyber Essentials: yes. Freemansland Creatives Pte. Ltd. (UEN 202321157G), the company that operates Decisionlore, is certified under the CSA Cybersecurity Certification, Cyber Essentials mark for ICT Vendors, certificate CEM-2026-256, issued by ISOCert Pte Ltd and valid from 1 September 2026 to 31 August 2028. The certified scope is the production and development environment of the ICT vendor for the service. DPTM and ISO 27001: no. Both sit on the compliance roadmap above with no target date published, and we will state a date only once one is real.
Is Decisionlore itself certified, or the company behind it?
The company. A certification body audits an organisation, its people and its environment, never a piece of software, so the certified party is Freemansland Creatives Pte. Ltd. (UEN 202321157G) and never the Decisionlore product. What Cyber Essentials for ICT Vendors covers is the production and development environment that Decisionlore is built and run in, which is exactly why it is worth knowing as a buyer. It remains a statement about the company.
Found a security issue?
Email nick@freemanslandcreatives.com. We respond within one business day. We don't pursue good-faith security researchers.