Where are WiPOS servers located?

WiPOS cloud data is hosted on Amazon Web Services (AWS) in the Singapore region (ap-southeast-1), the closest major cloud region to Malaysia. A working copy of your data is also kept on your own Android device so the POS keeps selling when the internet is down.

Is WiPOS data encrypted?

Yes. All traffic between the WiPOS app, the web dashboard and the cloud is encrypted with TLS (HTTPS), and all data stored in the cloud database and file storage is encrypted at rest with AES-256.

Can other WiPOS businesses see my sales data?

No. Every table in the WiPOS database is protected by row-level security, so each request is checked by the database itself and a signed-in user can only ever read or change rows that belong to their own business.

Does WiPOS store card details?

No. DuitNow QR payments are handled by a licensed payment gateway and WiPOS subscriptions are billed through Stripe's hosted checkout. Card and bank details never pass through or get stored in WiPOS systems.

What happens to my sales if the internet goes down?

WiPOS is offline-first. Every sale is saved on the device the moment it is completed, and uploaded to the cloud automatically when the connection returns, so you keep two copies: one on the device and one in the cloud.

Is WiPOS PDPA compliant?

WiPOS handles personal data in accordance with Malaysia's Personal Data Protection Act 2010, as amended in 2024. Data is transferred to Singapore for hosting, a jurisdiction with its own comparable Personal Data Protection Act.

Security & Data

In short: WiPOS data is hosted on Amazon Web Services (AWS) in Singapore, encrypted in transit and at rest, and walled off per business by the database itself. Every sale is saved on your device first and then in the cloud, and WiPOS never sees or stores card details.

At a glance

Server location	Amazon Web Services (AWS), Singapore region (ap-southeast-1), the closest major cloud region to Malaysia, which keeps sync fast.
Data centre standards	AWS data centres are independently audited against ISO/IEC 27001 and SOC 1, SOC 2 and SOC 3, with 24/7 physical security, redundant power and restricted entry.
Encryption in transit	TLS (HTTPS) on every connection between the Android app, the web dashboard and the cloud.
Encryption at rest	AES-256 for the cloud database and for stored files such as product photos.
Business isolation	Row-level security on every database table, so each business can only reach its own records.
Card data	Never received or stored by WiPOS. Payments go through a licensed payment gateway and Stripe.
Offline protection	Sales are saved on the device instantly and uploaded when the connection is available.
Law	Malaysia's Personal Data Protection Act 2010 (as amended in 2024).

1. Where your data is stored

Your business data (products, stock, sales, staff and, if you use the Customers add-on, your customer list) is stored in a managed PostgreSQL database hosted on Amazon Web Services in the Singapore region. Product photos are stored in encrypted cloud file storage in the same region.

Each Android device running WiPOS also keeps a working copy of your data, so the counter can keep selling when the internet is down. That copy is protected by your device's own lock screen (PIN, pattern or biometrics).

Because our servers are in Singapore, your data is transferred outside Malaysia. Singapore has its own Personal Data Protection Act that gives protection comparable to Malaysia's PDPA, and our hosting providers process the data only on our behalf, under data processing terms.

2. How your data is protected

Encrypted in transit. Every connection from the app and the dashboard uses TLS (HTTPS). Data is never sent over the network in plain text.
Encrypted at rest. The cloud database and file storage are encrypted with AES-256.
Isolated per business. Every table in the WiPOS database has row-level security switched on. The database itself checks every read and write, so even a faulty or tampered-with app cannot read another business's records.
Passwords and PINs are never stored readable. Account passwords are stored only as one-way hashes, and staff PINs are stored as salted one-way hashes.
Only your authorised devices. Each device is registered to your business, and only one device per business can record sales at a time. This stops a lost or unknown device from quietly adding transactions to your books.

3. Controls inside your shop

Staff accounts with roles. Each staff member signs in with their own PIN, and the owner decides what each role can do: open the drawer, give discounts, see reports, and so on.
Manager approval for sensitive actions. Voids, refunds, removing items, cutting a price or quantity, and opening the cash drawer without a sale can require a manager or owner PIN.
Audit trails. Approved adjustments and product changes are logged with who did it and when, and are visible in your web dashboard.
Cashier attribution. Every sale, void and refund records which staff member handled it.

4. Payments

WiPOS never receives or stores card numbers or bank account details. DuitNow QR payments are created directly with our licensed payment gateway partner, and your shopper pays the gateway or their bank directly. Your own WiPOS subscription is paid through Stripe's hosted checkout page, and your card details go straight to Stripe.

5. Keeping your sales safe

WiPOS is offline-first. A sale is written to the device's storage the moment it is completed, before anything is sent over the internet. When a connection is available, it is uploaded to the cloud automatically, and any sales made offline are sent as soon as the connection returns.

This means each completed sale exists in two places: on the device and in the cloud. If a device is lost or broken, sign in on a new device and your products, settings and synced sales history come back from the cloud.

You can also export your transaction and product data to Excel (.xlsx) at any time from within WiPOS, and keep your own copy.

6. Who can access your data

Your data belongs to you. Within your business, access is controlled by the staff roles you set up. At Winixlabs, account data is accessed only by authorised staff, and only when needed to provide support, fix a problem you have reported, or meet a legal obligation. Admin sign-ins are logged.

We do not sell, rent or share your data with advertisers, marketing platforms or data brokers. The full list of the kinds of providers we use is in our Privacy Policy.

7. Retention and deletion

Your data is kept while your subscription is active, plus 90 days after it ends so you can reactivate or export. After that it may be permanently deleted. You can ask us to delete your account and data at any time. See Section 7 of our Privacy Policy for details.

8. Report a security concern

If you think you have found a security problem in WiPOS, or you suspect someone has accessed your account, please email us straight away. We will acknowledge your report and keep you updated while we investigate.

Winixlabs Software Solutions

202603160766 (PG0589332-H)

Bandar Bukit Puchong, 47100 Puchong, Selangor, Malaysia

Email: info@wipos.cc