# Aligned with MAS guidance. Not certified by anyone, because nobody certifies this.

**Aligned with MAS guidance. Not certified by anyone, because nobody certifies this.**

MAS does not certify, approve or endorse vendor software. Any vendor telling you otherwise is either confused or hoping you are. What we can do is show you, control by control, how KrewOS is designed to support a regulated entity's obligations — and let you audit that mapping yourself.

Mapping reviewed against published MAS guidance as at 14 Aug 2026. Reviewed quarterly and on material change.

[Trust Centre](/trust/trust) · Sector alignment

[Book a compliance review](/book-demo) [Request the controls mapping](/trust/docportal)

KrewOS is not certified, approved, licensed or endorsed by the Monetary Authority of Singapore. Regulatory obligations — including technology risk management, outsourcing and third-party risk assessment, and any notification duties — remain those of the licensed entity. Where this page says "supports", it means the product provides a mechanism you can use as part of discharging an obligation that stays yours.

## Technology risk management

Mapped to the themes in the MAS Technology Risk Management Guidelines. Each row states the mechanism, and where the boundary of our responsibility sits.

| TRM theme | What KrewOS provides | Where the boundary is |
| - | - | - |
| Technology risk governance | Named component owners, verification tiers, release approval workflow and an immutable record of who promoted what | Your risk appetite and approval thresholds are yours to set |
| System development lifecycle | Immutable releases with locked dependencies, evaluation gates that block promotion, and shadow and canary release modes | Your change advisory process governs when a release is promoted |
| Access control | RBAC aligned to platform personas, SSO and MFA, SCIM lifecycle, segregation of duties on dual approval, quarterly access review reporting | Your directory is the source of truth for identity |
| Cryptography and key management | TLS 1.3 and AES-256, customer-managed keys on the Regulated tier, credentials held as encrypted references and injected at the call boundary | CMK rotation policy is yours to operate |
| Audit trail and logging | Immutable, append-only, exportable end-to-end trace covering run, node, model call, retrieval, tool, approval and cost | Retention beyond 7 years by agreement |
| Availability and recovery | 99.9% Control Plane availability committed under contract and remedied by service credit when missed; RPO ≤ 15 minutes and RTO ≤ 4 hours as targets; quarterly rehearsed restores with recorded results | Your own BCP must account for the platform being unavailable |
| Incident management | 24-hour notification from confirmation, written post-mortem within 10 business days, public status history | Regulatory notification is the licensed entity's duty |
| Cyber security operations | Annual third-party penetration testing plus release-triggered tests, dependency and container scanning, tamper-evident logging with 400-day retention | Testing of your own configuration and connectors is yours |
| Data loss prevention | Configurable detection and redaction before content reaches a model provider, with the redaction map held in-region | Classification rules are yours to define |

## Outsourcing and third-party risk

What an assessor needs when they treat KrewOS as a service provider. Every item here is available without a sales conversation, most of it on this site.

**Due diligence pack**

Corporate details, financial standing, insurance certificate, security posture, subprocessor register and business continuity summary, assembled for a third-party risk assessment.

**Audit rights**

The Regulated tier includes contractual audit and inspection rights, including regulator access, and an annual assurance meeting with your risk function.

**Subprocessor control**

Full published register with 30 days' notice before any addition and a contractual objection window. Material subprocessors are named, not described as "cloud providers".

**Exit and portability**

Export the complete engineering repository at any time — manifests, components, schemas, prompts you own, policies, evaluations and deployment files — plus a machine-readable audit export.

**Concentration risk**

Model provider diversity is a first-class configuration: model profiles support fallback chains across providers, and BYOK lets you keep your own contractual relationships.

**Location of processing**

Singapore only on managed tiers, with the Customer VPC, Hybrid and Private options where your assessment requires processing inside your own perimeter.

## FEAT principles

Fairness, Ethics, Accountability and Transparency, as set out in the MAS principles and elaborated through the Veritas work. These map unusually well, because the product was designed around the same problem.

| Principle | Mechanism in KrewOS | Evidence you can show |
| - | - | - |
| Fairness | Evaluation suites include disputed and edge cases; where sources of comparable authority disagree, both positions are carried forward rather than one being silently selected | Evaluation results by case class, conflict-surfacing records |
| Ethics | No autonomous high-impact actions; approval gates are compiled in, not configured on trust; abstention below the evidence floor is the default failure mode | Compiler proof output, abstention rate by crew |
| Accountability | Every approval, rejection and edit is an immutable Correction Record tied to a named individual, a run, a release and a component version | Audit export with named reviewers and timestamps |
| Transparency | Every claim carries its sources with authority tier and date; every node run records the exact component version, model profile, prompt version, tools, knowledge and policies used | Evidence records, end-to-end run trace |

**Legal practice and professional conduct**

For law firms the analogous questions are professional conduct, confidentiality and privilege rather than prudential regulation. The position is the same in shape: the platform supports the professional, and the professional remains accountable.

**No legal advice**

KrewOS does not give legal advice and does not replace a qualified professional. Regulated outputs stay at 100% human review permanently and cannot be graduated out of it.

**Privilege and confidentiality**

Per-matter access control, deterministic privilege screening, and an audit trail that shows who saw what and when.

**Conflicts**

Conflict screening runs as a deterministic gate at matter intake, before any substantive work is scheduled.

**Supervision**

The named approver on every regulated output is a real, identified person, recorded immutably. That is the sentence a firm needs to be able to say.

**What we will not say**

These phrases appear nowhere on this site, in any proposal, or in any answer a salesperson gives you. If you hear one, it is wrong and we would like to know.

MAS certified MAS approved regulator approved PDPA compliant fully autonomous AI employee no hallucinations guaranteed correct

What we say instead: aligned with named guidance, designed to support your obligations, progressive autonomy, abstains below its declared evidence floor.

[See the certification position](/trust/certs)

---

wGrow Technologies Pte Ltd · Singapore · Control mappings are wGrow's published assessment against publicly available guidance. They are not a regulatory determination and confer no regulatory status on any user of the platform.

Canonical page: https://dev.krewos.ai/trust/mas