At StashAway, we take security seriously and strive to ensure that while we focus on customer experience, usability and product reliability, it is secured as well. However, nothing is perfect and we encourage the reporting of suspected vulnerabilities or weaknesses in our IT services and systems through our Vulnerability Disclosure Programme (VDP). You can find more information on how to report <a class="c-link" tabindex="-1" href="https://vdp.stashaway.com/" target="_blank" rel="noopener" data-stringify-link="https://vdp.stashaway.com/" data-sk="tooltip_parent" data-remove-tab-index="true">here</a>.
 
Please also note that the VDP does not authorise or permit the taking of any action which may contravene applicable laws and regulations (e.g. Computer Misuse Act). For the avoidance of doubt, attempts to exploit or test suspected vulnerabilities (e.g. gaining unauthorised access to any computer program or data) are prohibited.

How to report security vulnerabilities?

The categories and suggestions below, many of which may apply to your home as well as your office, are some suggestions which you can and should adopt to ensure a secure online experience: Protect your computer
<ul>
<li>Install anti-virus software and the latest security patch on the computer you use to access StashAway</li>
<li>Set it so that it performs automatic updates</li>
<li>Remove file and printer sharing, especially when connected to the internet</li>
<li>Consider the use of encryption technology and perform regular backups to protect critical data</li>
<li>Only allow trusted USB drives into your computer</li>
<li>Get in the habit of locking your account whenever you step away from your computer</li>
<li>Only use trusted devices and access trusted websites</li>
<li>Do not install or run programs that are not from trusted websites</li>
<li>Delete junk/chain emails</li>
<li>Do not access sensitive online sites or perform financial transactions over the public internet</li>
<li>Clear browser cache after each online session</li>
<li>Log off after each online session</li>
</ul>
 
Protect your mobile device
<ul>
<li>Always update your device to the latest available OS version; these patches normally carry security and bug fixes that will help secure your device and the information stored on it</li>
<li>Do not attempt to ‘jailbreak’ or ‘root’ your device</li>
<li>Keep your laptop, your mobile phone, and other portable devices that contain sensitive information with you at all times</li>
</ul>
 
Protect your network
<ul>
<li>Set a strong password for your WiFi network </li>
<li>Do not allow anyone to connect to your network without permission</li>
</ul>
You can also learn more about protecting your data and finances from our article <a href="https://www.stashaway.my/r/how-to-protect-your-personal-data-and-finances" target="_self" rel="undefined">here</a>

How should I protect my Devices and Computer Systems?

Your money is kept entirely unmingled with StashAway's finances, and your assets will always be held in large institutions. Your cash deposits will be held by our Trustees, Pacific Trustees, in their account at Citibank Berhad.
 
Citibank Berhad will then convert your RM into USD onshore, and transfer it to our broker (Saxo Capital Markets Pte Ltd), which purchases the ETFs on your behalf. Therefore, your investable cash and securities are held in a custodian account at Saxo. Pacific Trustees is a SC-licensed trustee that provides custodial services to StashAway Malaysia.
 
Your cash deposits are held with Pacific Trustees's Citibank Berhad account. Pacific Trustees has opened this account specifically to keep safe the assets of StashAway Malaysia's customers. Similarly, the account with our broker Saxo is also opened by Pacific Trustees. This provides additional security for customers and protects customers from the unlikely event that StashAway Malaysia goes bankrupt, as customers' funds are unmingled with StashAway Malaysia's.
 
We are regulated by the Securities Commission Malaysia. StashAway is the first robo-advisor in Malaysia to be awarded the Capital Markets License by the Securities Commission under the Digital Investment License Framework. You can find our license <a style="background-color: #ffffff;" href="https://easy.seccom.com.my:8222/entityprofile/1ca93ae1-4c0e-4c55-90e0-1850600e54f6" target="_self" rel="undefined">here</a>.

Where is my money kept?

Your personal information is securely stored in our databases, in accordance with the PDPA and other applicable data protection and privacy laws. Where the business is required to share such information in the process of providing our services to you, care is given to ensure that the same duty of confidence and security is applied.
Learn more about our security: <a href="https://www.stashaway.my/security" target="_blank" rel="noopener noreferrer">StashAway Security</a>

Where is my personal information stored?

We do not outsource customer service to third party providers. All our staff are trained in-house so that we have tighter controls over the onboarding process, and our Client Experience team does not forward customer documents to any other department in the company.
 
Access to our corporate network is only for authorized personnel and specific devices.  We practice the Principle of Least Privilege, where we only assign just enough access for staff to perform his/her job. Hence only very limited staff has access to customer information.
 
We have to be compliant with the Personal Data Protection Act and MAS Technology Risk Management (TRM) Guidelines to attain and maintain our Capital Markets Services License.
 
<iframe src="//www.youtube-nocookie.com/embed/K9gmAkutCDw" width="560" height="315" frameborder="0" allowfullscreen=""></iframe>

Who has access to my information?

If you wish to transfer funds into your StashAway account from a bank account based outside of Malaysia, Malaysia regulations necessitate further checks to verify your identity.
Do note that withdrawals can only be made to local Malaysian bank account.

Why do you ask the question about which country my bank account is from?

You may, at any time, withdraw your consent to the collection, use, or disclosure of personal data from us. One way to withdraw your consent is to click “Unsubscribe”, available on all marketing or newsletter emails that you may receive from us. 
Otherwise, you may contact our Data Protection Officer at <a href="mailto:dataprotection@stashaway.my" target="_self">dataprotection@stashaway.my</a>, should you require more assistance. We will strive to process your withdrawal request within 10 business days and will inform you accordingly should we need more time. 
We also strive to inform you of any likely consequences as a result of your withdrawal request.

How do I withdraw consent previously given in relation to my Personal Data?

As a regulated entity, SAMY is obliged to identify and verify the identity of customers as part of the customer due diligence <a href="https://www.sc.com.my/regulation/guidelines/amla" target="_self">requirements</a>. SAMY is adopting the WhatsApp solution to enhance the overall CDD processes of non face-to-face business relationship establishment.
 Documents are requested only via our authorised corporate WhatsApp number which is connected to our secured StashAway network, protected by a firewall, and requires multi-factor authentication to access. It is a VPN, just like your bank’s intranet. WhatsApp also has end-to-end encryption.

How secure is WhatsApp?

We have taken every possible measure to protect your assets, from requiring two-factor authentication for any changes and identity verification for withdrawals, building a secure server infrastructure to protect you from cyber attacks, and partnering with a large bank to store your assets. To learn more, please visit: <a href="https://www.stashaway.my/security">https://www.stashaway.my/security</a>

What safeguards does StashAway have in place to ensure that my assets are protected from fraud?

Your money is kept entirely unmingled with StashAway's finances. To ensure that we never touch your money, we use custodian banks that hold your money, whether it's in cash or in securities.
StashAway has made it a top priority to work with global, reputable banks for these purposes. Our custodian bank for receiving your deposits is Citibank Berhad, while Saxo Capital Markets Pte Ltd is our custodian for your investible cash and securities.
In these custodian institutions, your assets are always in a segregated account-- one that is separate from StashAway's operations and assets. This means that you will always have full access and claim to your assets no matter what happens to StashAway.

What happens to my money if StashAway gets acquired, goes public, or closes?

Digital certificates provide security to websites by encrypting sensitive data and verifying the identity of the websites that are secured. 
SSL problem messages and warnings are often displayed in an attempt to protect website users from potentially compromising situations. 
If you ever encounter an SSL related warning (such as a security certificate mismatch, certificate not trusted, or secure and non-secure items) while visiting StashAway’s site, you may want to hold off on entering your login details until you can make sure you are not in a compromising online situation. 
To resolve a problem that you may be having, the first thing that you want to check is that your computer's time and date are accurate. Because expired or not-yet-valid security certificates throw up warnings, having the date on your machine wrong could potentially cause security errors on many secure sites that you access. 
Additionally, if you have recently enabled new secure settings in a website, try disabling those settings and see if the warning messages go away. While this is not a fix, it can give you a point to work from when communicating with our Client Engagement Team and help them to provide more details for our team of exports fix the issue faster. 
If the problem persists, contact us via email at <a href="mailto:support@stashaway.com">support@stashaway.com</a> and our team of experts are available to help resolve the issue.
Reference: https://www.digicert.com/ssl-problems.htm

I received a SSL Server Certificate warning, what should I do?

Passive income

New: Get regular dividend payouts with our Passive Income portfolio

We’re licensed by the Securities Commission Malaysia (Licence <a href="https://easy.seccom.com.my:8222/entityprofile/1ca93ae1-4c0e-4c55-90e0-1850600e54f6">eCMSL/A0352/2018</a>).

Help Center

We’re licensed by the Monetary Authority of Singapore (License no.&nbsp;<a href="https://eservices.mas.gov.sg/fid/institution/detail/201134-ASIA-WEALTH-PLATFORM-PTE-LTD">CMS100604</a>).

We’re licensed by the Securities and Futures Commission of Hong Kong (<a></a><a href="https://apps.sfc.hk/publicregWeb/corp/BQE542/details" target="_blank">CE No. BQE542</a>)

We’re licensed by the Securities and Exchange Commission (License no.&nbsp;<a></a><a href="https://market.sec.or.th/public/idisc/en/companyprofile/Intermediaries/0000031407" target="_blank">Lor Khor-0136-01</a>).

StashAway Management (DIFC) Limited is regulated by the DFSA (license number&nbsp;<a href="https://www.dfsa.ae/public-register/firms/stashaway-management-difc-limited">F006312</a>).