PDPA fines now reach RM 1,000,000 — and since the 2024
Amendment, data processors are directly liable, not just their clients.
AuditCore reads your website and your code the way an auditor would, and scores every gap
between your files and Malaysian law — in plain language, before your regulator finds it first.
Free website compliance check — no account required
Checks your public website: SSL, HTTPS, security headers, privacy policy, email security (SPF/DMARC).
No login. No credit card. Results in under 10 seconds.
The link shows only what you see above — grade, score, and these findings.
No email, no locked findings. It expires after 90 days.
Get the full 16-check report — free
Enter your email. We'll run a comprehensive scan covering security headers,
cookie consent, DPO contact, DMARC, SPF, admin panel exposure, and tracker inventory.
Report emailed within 60 seconds.
✓ Full scan started — your report will arrive within 60 seconds.
Check your inbox (and junk folder).
Which one is you?
Every sector has its own laws, its own regulator, and its own most-common gap. Find yours — then run the free check above.
Clinics & Healthcare
Patient records are sensitive personal data under PDPA. One unencrypted export or
missing consent record starts the 72-hour breach clock — with fines up to RM 1M.
You hold IC numbers, salaries, and medical records for other companies. The 2024 Amendment
makes you — the processor — directly liable, not just your clients.
Cookie consent, tracker inventories, and checkout security are the first things enterprise
procurement teams and PDPA sweeps flag — and the cheapest to fix once you know.
BNM's RMiT expects evidence, not assurances. The BNM and InsurTech profiles map your stack
against 31 sector-specific checks before your next composite audit does.
Using an LLM, a scoring engine, or automated decisions? The National AI Office's AIGE guidelines
recommend a risk assessment and an explainability trail — and an AI Governance Bill is under public consultation.
Tenant ICs, income statements, and viewing records accumulate in agent inboxes. Every file
kept past its purpose is retention liability under PDPA s.10.
The three gaps that cost Malaysian businesses the most
Identified in every audit we run. All three are fixable in a day — once you know they exist.
01 / 03
RM 1M exposure sitting in your privacy policy
The PDPA 2024 Amendment makes data processors directly liable — not just controllers.
A policy last updated before 2024 does not cover processor liability, the 72-hour breach clock,
or mandatory notification to data subjects. Each is a separate fine trigger.
AuditCore checks your actual policy document — not just what you claim — against the current law.
02 / 03
One missing header fails your next vendor audit
Enterprise procurement teams run automated vendor security checks.
Missing HSTS, Content-Security-Policy, or DMARC shows up as an OWASP A05 flag —
and stalls or kills the deal. These take 30 minutes to configure.
Most Malaysian SME sites are missing at least two.
03 / 03
AI with no governance trail is hard to defend
If your product uses an LLM, recommendation engine, or automated scoring,
the National AI Office's AIGE guidelines (voluntary) recommend a risk assessment,
an explainability mechanism and human oversight, and Malaysia's proposed AI Governance Bill is under public consultation.
Without documentation, you have nothing to show a customer, an auditor or a regulator.
How AuditCore works
From first look to boardroom artefact — four steps.
STEP 1
Free website check
Enter your URL above. Ten seconds, no account, no card — your grade and top findings on screen.
STEP 2
Full report — still free
Add your email for the complete 16-check website report, delivered with remediation steps within a minute.
STEP 3
Codebase audit
Subscribe to audit your actual source code — 222 checks across 15 profiles. Upload a ZIP or point at a path; results in under a minute.
STEP 4
Assessment report & DPO reporting
Grade A/B earns a signed, timestamped compliance assessment report — reproducible, so a third party can re-run the scan and confirm it. Monthly DPO reports keep the paper trail current.
Paid Plans · Codebase Compliance Audit
Go beyond your website — audit your actual code
The free website check scans what your customers see. The codebase audit scans what your
regulator will inspect — your source code, configuration files, environment settings, and
documentation against 222 checks across 15 Malaysian and international compliance profiles.
222
Compliance checks
15
Regulatory profiles
Local
AI — runs on-premises, no data leaves Malaysia
PDF
Signed, timestamped compliance report
PDPA 2024NAIO AI GovernanceAct 854BNM RMiTHR TechInsurTechPropTechHealth DataSovereignOWASP Top 10ISO 27001CIS BenchmarksNIST CSFGDPRSecrets Detection
Scan your codebase by providing a project path — or upload a ZIP archive directly from your
browser. AuditCore processes everything on-premises in Malaysia. No file content leaves the platform.
Results arrive in under 60 seconds.
PDPA 2010 + 2024 AmendmentNAIO AIGE + proposed AI Governance BillCyber Security Act 854OWASP Top 10CIS BenchmarksGDPRISO 27001:2022NIST CSF
Compliance Visibility — before your regulator asks
A full AuditCore scan covers your codebase, PDPA posture, NAIO AI governance,
Act 854 controls, and API security — then generates a signed, timestamped
artefact you can share with customers, partners, and regulators.
AuditCore generates the artefacts. Your compliance officer acts on them. Auditor-in-the-Loop — by design. Scan results do not constitute legal advice.