This page only describes what is true today. What we don't have yet is in the last section; there are no "coming soon" claims here. If any of this stops being true, this page changes with it.
Who we are
S.I.S. (Super Invoicing System) is run by Madvengers Production, Malaysian business registration 003357155-P. A real business with a phone number: 018-252 6873.
Where your data lives
Everything (clients, invoices, payments, uploaded receipts) is stored in Supabase's Singapore region (ap-southeast-1). The site runs on Vercel's Singapore edge. We don't sell your data and we don't hand it to anyone for marketing.
The site is on a .app domain, so browsers force an encrypted connection. There is no unencrypted way in.
Who can reach it
Each studio's data is isolated at the database level with row-level security: once signed in you can only read your own studio's rows. That wall is inside the database, not hidden in the interface. Two exceptions. People you invite yourself. And the SIS operator: for billing, support and abuse prevention its console shows each studio's account email, plan, client and invoice counts, total invoiced and AI usage, but not individual invoices or client details. Opening your studio's records needs the support access you grant in Settings (a security emergency aside), and every visit is logged for you to see. Like any hosted service, the operator can also reach the database for backups and maintenance.
By default our super-admin account cannot enter your studio. We can only come in to help after you grant access in Settings (valid 24 hours, revocable any time). The one exception is an emergency — a data breach or a system fault that needs urgent handling — when we may enter without a grant; that entry is flagged as an “emergency access” with a reason, and it appears in your log the same way. Every entry emails you right away (with the reason) and is logged, and you can see the log in Settings at any time.
Backups and recovery
The whole database is exported automatically four times a day (2am, noon, 5pm and 10pm Malaysian time), invoicing happens during working hours, so we don't wait for midnight. The nightly copy is kept for 90 days, the daytime ones for 14.
Backups are stored separately from the live database, so your data survives even if the Supabase project is lost entirely.
Payments
Subscription payments are handled by Stripe. Your card number never passes through our system and we never store it.
The AI features
The in-app assistant and the AI that reads invoices, receipts and statements are Anthropic's Claude, whose commercial terms exclude training on your content. You can also add your own Claude key on the Company page to run the AI on your own account. Preferences you ask the assistant to remember are stored under your own account only and can be deleted on the assistant page at any time; the defaults it works out from your records (usual payment method, terms, regular crew) stay inside your studio. None of this is used to train any model.
Third parties we use
Vercel (hosting) · Supabase (database and file storage, Singapore) · Stripe (payments) · Anthropic (AI assistant and document reading) · Resend (email delivery) · Google (optional: sign-in; and backing your invoices up to your own Google Drive, after you connect it). We update this page when the list changes.
Your data is yours
Reports export to CSV (opens in Excel) any time, and invoices download as PDF. Leave whenever you want and take your data with you. For a full export or deletion, just write to us.
If something goes wrong
Under Malaysia's PDPA (including the 2024 amendment), if a breach occurs that is likely to cause significant harm, we notify the Commissioner within 72 hours of becoming aware and tell the affected users.
What we don't have yet (honestly)
We are not ISO 27001 or SOC 2 certified and we have not had a third-party penetration test. Those cost real money, and we'll do them when a customer genuinely needs them. We are also not yet connected to LHDN's e-Invoice (MyInvois). We won't claim what we haven't built.
Contact
Security questions, data exports, or a vulnerability you found: sisworkflowapp@gmail.com or WhatsApp 018-252 6873. If you find a hole, tell us first and give us time to fix it, we'll thank you properly.
Last updated: 2026-09-21