SSO Privacy Notice

Central sign-on for SWM Penang applications.

Last updated: 8 June 2026

What we store

• Your name and email
• Your password (as a hash only — not recoverable)
• Your two-factor (TOTP) secret, if you enrol
• Sign-in history: date, time, and IP address — for audit and security
• Browser session cookies

What we don't store

• No passwords in plaintext
• No advertising trackers or analytics
• No data sent to third parties

How long

Account details are kept while your account is active. Sign-in history is kept for 2 years for audit purposes.

Your rights

To see, correct, or delete your personal data, email [email protected].

Security

Traffic is encrypted via HTTPS. Every account requires two-factor authentication. The system is protected against brute-force attacks.