Trust
Licences, security and where your data lives
Who we are, what we hold, who certifies what, and how to ask for the documents your procurement team needs.
ORENCloud Sdn Bhd (company no. 1052609-M) is a Malaysian cloud communications provider in Puchong, Selangor, licensed by MCMC as an Applications Service Provider (Class), ASP-C. It lists a TM-certified PBX, Meta Tech Provider and MDEC Malaysia Digital company status, and PDPA compliance. The platform runs from AIMS Kuala Lumpur and CX2 Cyberjaya, and procurement documents can be requested.
Company details
The same details appear on our contact page and in our policies.
- Legal entity
- ORENCloud Sdn Bhd
- Company number
- 1052609-M
- Founded
- 2013
- Office address
- Tower 5@PFCC, Jalan Puteri 1/2, Bandar Puteri, 47100 Puchong, Selangor, Malaysia
- Sales
- +60 3-2724 2500, hey@orencloud.com
- Support and security reports
- support@orencloud.com
Policies and service commitments
Licences and credentials
Each row says who holds the credential, so ORENCloud’s own licences are not confused with those of the data centres we use.
| Credential | Held by | What it means | Evidence |
|---|---|---|---|
| MCMC licence: Applications Service Provider (Class), ASP-C | ORENCloud | Licence from the Malaysian Communications and Multimedia Commission to provide applications services in Malaysia. | Ask for a copy of the licence in your procurement request. |
| TM-certified PBX | ORENCloud | Our PBX is certified by TM, as shown on our certification badges. | Ask for the certificate if you need it. |
| Meta Tech Provider | ORENCloud | Official Meta Tech Provider for the WhatsApp Business API (since 2025). We onboard WhatsApp accounts directly. | Ask us for the onboarding evidence. |
| MDEC Malaysia Digital status | ORENCloud | ORENCloud is an MDEC Malaysia Digital company. Our old website also displayed an MDEC SME grant badge. | Ask us for the MDEC status evidence. This is not an offer of funding. |
| Personal Data Protection Act 2010 (PDPA) | ORENCloud | We state that ORENCloud complies with the PDPA. Our privacy policy explains how we handle personal data. | Read the privacy policy. |
| PCI-DSS grade hosting | Data centres | Our infrastructure is hosted in PCI-DSS grade data centres. For regulated customers we also set up private instances that can be tested against banking-grade standards such as PCI-DSS. | This is a statement about the hosting and a readiness option, not a PCI-DSS certificate held by ORENCloud. |
| ISO 27001 grade hosting | Data centres | Our infrastructure is hosted in ISO 27001 grade data centres. Certifications and security assessments differ by facility. The data-centre operators name ISO/IEC 20000-1, ISO 9001, TIA-942 and the Green Building Index as certifications, and TVRA as a security assessment. Ask for the current certificates, editions and scope for each site. | These belong to the facilities, not to ORENCloud. Ask us for the current facility-specific certificate, edition and scope. |
We do not link to a verification record unless we can give you the exact entry. Ask, and we will provide what we can.
Hosting and processing locations
Our infrastructure is hosted in AIMS Kuala Lumpur and CX2 Cyberjaya. Some supporting services sit elsewhere, and we list them.
How users connect
Your users
Connections to the platform are encrypted. At least two firewalls and location-aware access rules sit in front of it, and OMNI adds two-factor sign-in and role-based access.
Data centre, Kuala Lumpur
AIMS Kuala Lumpur
One of the two data centres in Malaysia where our core voice and messaging platform runs. Certificates differ by facility, so ask us for the current certificates and scope for this site.
Data centre, Cyberjaya
CX2 Cyberjaya
The other data centre in Malaysia where our core voice and messaging platform runs. As with AIMS, ask us for the current facility certificates and scope for this site.
Cloud providers
Supporting services
Some supporting services use cloud providers, such as monitoring tools that include DigitalOcean in Singapore, and encrypted OMNI attachment storage on Amazon S3. The table below lists each one.
Core platform: paired servers replicate in real time, side by side in different racks.
| What | Where | Note |
|---|---|---|
| Core voice and messaging platform | AIMS Kuala Lumpur and CX2 Cyberjaya, Malaysia | Paired servers replicate in real time, side by side in different racks. |
| Public cloud capacity | Built on leading public cloud providers, including DigitalOcean, AWS and Cloudflare | Ask which components use which provider for your deployment. |
| Monitoring tools | Inside and outside our data centres, including DigitalOcean in Singapore | Monitoring is for service health. |
| OMNI attachments | Amazon S3, encrypted, behind Cloudflare’s web application firewall and bot protection | The storage region is not stated here. Ask us. |
| AI processing | Local or cloud inferencing, depending on the deployment | Ask for the processing location of the product you plan to use. |
| Private instances | Your premises, our cloud or a private cloud of your choice | Available for customers who need control of data location. |
Security measures
Layered firewalls and geoblocking
At least two firewalls, one filtering known attacks and one that understands the application, plus location-aware access rules.
Encryption and access control
Encrypted connections, two-factor sign-in and role-based access in OMNI.
24x7x365 monitoring
Servers, network devices and carrier links are monitored round the clock.
Private instances
Run the platform on your premises, in our cloud or in a private cloud for stricter control.
Request procurement documents
Tell us what your team needs. For example, a copy of our licence, company registration details, partner or data centre certificates, or answers to a security questionnaire.
We will confirm what we can share and send it. Use the contact form and mention that it is for procurement.
Trust and security questions
Is ORENCloud licensed in Malaysia?
Yes. ORENCloud Sdn Bhd is licensed by MCMC as an Applications Service Provider (Class), ASP-C. Ask for a copy of the licence through the procurement request below. MCMC publishes information on class licences.
Is ORENCloud PCI-DSS or ISO 27001 certified?
We host in PCI-DSS grade and ISO 27001 grade data centres, so those standards describe the facilities. We do not claim a PCI-DSS or ISO 27001 certificate for ORENCloud itself on this page. For regulated work we set up private instances that can be tested against PCI-DSS.
Where is my data stored and processed?
The core platform runs in AIMS Kuala Lumpur and CX2 Cyberjaya. Some supporting services, such as monitoring and OMNI attachment storage, use cloud providers. See the hosting table above and ask us for the locations that apply to your products.
What uptime does ORENCloud guarantee?
The contractual commitment is at least 98% uptime each calendar month, with service credits of 10% to 50% if it is missed. See the service level guarantee. Uptime figures on the architecture page are measurements, not the guarantee.
How do I report a security issue?
Read the responsible disclosure policy and email support@orencloud.com.
Can I get documents for procurement or due diligence?
Yes, ask. Use the contact form and say what your procurement team needs, such as a licence copy, company registration details, certificates or a security questionnaire. We will confirm what we can share.
Where these statements come from
Read October 2026. External pages can change; follow the links for the current wording.
- ORENCloud: home page credentials statement MCMC ASP-C, TM certified PBX, Meta Tech Provider, MDEC, PDPA, PCI-DSS grade hosting.
- ORENCloud: platform architecture Data centres, certifications of the facilities, firewalls and monitoring.
- ORENCloud: privacy policy
- MCMC: class licences General information about class licences.
Need documents for your vendor review?
Send us your checklist. We will tell you what we can provide and who will answer your questions.