Cybersecurity Law Compliance

The Law on Cybersecurity 2018 (Luật An ninh mạng 2018) — passed by the National Assembly of Vietnam on 12 June 2018 and in force from 1 January 2019 — is the umbrella statute that governs the security of information systems and the localisation of certain classes of data in Vietnam. It is complemented by Decree 53/2022/ND-CP, which sets out the detailed procedures. This page explains how SiteminderStore Vietnam Company Limited operationalises the Law for the Marketplace and for the Modules we distribute, with a particular emphasis on the localisation obligation of Article 26.

§ 01Overview of the Law

The Law on Cybersecurity has forty-three articles organised in seven chapters. It covers the protection of national security in cyberspace, the classification of critical information infrastructure, the responsibilities of operators of information systems, the localisation of certain categories of data, the removal of unlawful content, and cooperation with the specialised force of the Ministry of Public Security (Bộ Công an) — the Department of Cybersecurity and High-Tech Crime Prevention, commonly abbreviated A05.

§ 02Scope — who the Law applies to

Article 2 of the Law applies it to every agency, organisation, and individual involved in activities related to the protection of national security in cyberspace on the territory of Vietnam. In practice this includes operators of information systems that store personal data of Vietnamese users, operators of e-commerce platforms, operators of social networks, and providers of online services. SiteminderStore falls within this scope both as the operator of siteminderstore.org and as the operator of the Modules that process personal data of Vietnamese hotel guests on behalf of its Customers.

§ 03Article 26 — the localisation obligation

Article 26 requires, among other things, that domestic and foreign enterprises providing services in cyberspace in Vietnam and collecting, exploiting, or analysing personal data of Vietnamese users store that data in Vietnam for the duration prescribed by the Government. Decree 53/2022/ND-CP fleshes out the requirement: the retention period runs from the moment the enterprise starts operating in Vietnam and lasts for at least twenty-four months from the moment the data is no longer used; foreign enterprises must also establish a representative office in Vietnam. SiteminderStore, as a Vietnamese company registered with the Ministry of Planning and Investment, meets the establishment requirement inherently.

§ 04Where we host what

The following table sets out where each category of data is stored and why.

Category	Primary storage	Cross-border replication
Customer account data	Viettel IDC — HCMC	None
Billing and e-invoicing records	Viettel IDC — HCMC, with a warm replica in Viettel IDC — Hà Nội	None
Guest personal data flowing through a Module	Viettel IDC — HCMC and Viettel IDC — Hà Nội	None
Support ticket content	Viettel IDC — HCMC	None
Server logs and security telemetry (raw, IP-carrying)	Viettel IDC — HCMC	None
Aggregated, de-identified operational metrics	Viettel IDC — HCMC	Amazon Web Services — Singapore (for regional latency and disaster recovery)
Control-plane secrets (envelope-encryption keys only)	AWS KMS — Singapore	Managed by AWS with multi-region redundancy

§ 05Why the Singapore replica is compliant

The Singapore replica does not contain personal data of Vietnamese users. It contains only aggregated, de-identified operational metrics — counters of API calls per Module, latency distributions, feature-usage histograms, hashed session identifiers truncated to eight bytes. The purpose of the replica is to enable regional latency optimisation for our own service dashboards and to provide a disaster-recovery target should both Viettel IDC datacentres be affected by a catastrophic event on the same day. Because the replica does not identify any Vietnamese user, it is outside the scope of the Article 26 localisation obligation. It is nevertheless covered by an Article-25 Cross-Border Transfer Impact Assessment under Decree 13, which we refresh every twelve months.

§ 06Content-moderation obligations

Articles 8, 16, and 26 of the Law prohibit the use of cyberspace to distribute content that opposes the State, incites violence, discloses state secrets, spreads false information causing public disorder, or infringes the lawful rights of organisations and individuals. The Marketplace hosts commercial content — Module descriptions, customer testimonials, editorial articles about hotel operations. That content is moderated before publication and is subject to takedown within twenty-four hours of a substantiated report. Customer-facing surfaces of the Modules (guest-facing landing pages, mailings) are the responsibility of the Customer; the Acceptable Use Policy requires Customers to abstain from publishing prohibited content through those surfaces.

§ 07Cooperation with A05

SiteminderStore cooperates in full with the Department of Cybersecurity and High-Tech Crime Prevention of the Ministry of Public Security. Where A05 sends a written request for information about a Customer, a piece of content, or an incident, we handle it through a documented internal workflow that guarantees timely response, appropriate escalation to counsel, and, where legally possible, notice to the affected Customer. Where a request is disproportionate or unlawful we may challenge it before the competent Vietnamese court before disclosing any information. Where cooperation requires the temporary suspension of a Module or of a Customer account, we implement the suspension immediately and lift it as soon as A05 confirms that it is no longer required.

§ 08Incident-response workflow

Our written run-book covers the following stages:

1. Detection. Continuous monitoring by an in-house security-operations team backed by an out-of-hours on-call rotation. Anomalies are classified within fifteen minutes as either "false positive", "operational event", or "security incident".
2. Containment. A named incident commander assumes responsibility for the incident. Containment measures — credential rotation, network isolation, ingress rate-limiting — are applied within the first hour.
3. Assessment. The scope of the incident is assessed against the definition of "personal data breach" in Decree 13 and against the classification of the affected information system under the Law on Cybersecurity.
4. Notification. Where the incident constitutes a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we notify affected Customers within twenty-four hours and A05 within seventy-two hours through the online portal it operates.
5. Remediation. The root cause is identified, a permanent fix is deployed, and preventative controls are added.
6. Post-incident review. Within fifteen business days of the closure of the incident, the incident commander produces a written post-mortem that is reviewed by the compliance committee and, where appropriate, shared with the affected Customers.

§ 09Sanctions in case of non-compliance

Non-compliance with the Law on Cybersecurity exposes the operator of the information system to administrative fines the maximum amount of which is set by Decree 15/2020/ND-CP on administrative sanctions in the field of post, telecommunications, information technology, and radio-electronic frequencies. Depending on the infringement the fines range from a few million to several hundred million đồng per infringement, with higher ceilings for repeat offenders. Serious cases may lead to the temporary suspension of the service, to the mandatory removal of unlawful content, and, in extreme cases, to criminal liability under the Penal Code. Our compliance programme is designed to keep the Marketplace safely within the rules.

§ 10How Customers can verify our compliance

Customers on the enterprise tier can request the following documentation, subject to a written confidentiality undertaking:

• The registration certificate of SiteminderStore Vietnam Company Limited (Business Registration Certificate No. 0316854921).
• The map of the Viettel IDC racks that host the primary and secondary infrastructure.
• The written data-processing agreement with Viettel IDC.
• The written data-processing addendum with Amazon Web Services covering the Singapore replica.
• The Cross-Border Transfer Impact Assessment under Article 25 of Decree 13.
• The most recent penetration-test report by an independent Vietnamese firm accredited by A05, redacted for third-party findings.
• The annual compliance attestation described in the next section.

§ 11Annual attestation

Every year, in the first quarter, our compliance committee publishes an annual attestation that summarises the state of our compliance with the Law on Cybersecurity and with Decree 13. The attestation covers the security incidents of the previous year (redacted for confidential details), the changes to the map of the datacentres, the changes to the list of subprocessors, the outcome of the penetration tests, and the training programme delivered to our staff. The attestation is signed by the director, Nguyễn Minh Đức, and by the Data Protection Officer. It is available on request to Customers on any tier.

§ 12Interaction with sector-specific rules

The Law on Cybersecurity coexists with sector-specific rules relevant to hospitality: the Law on Tourism 2017 (Luật Du lịch 2017) that governs the operation of accommodation establishments; Circular 06/2017/TT-BVHTTDL that sets out the classification of accommodation; Decree 96/2016/ND-CP on the reporting of foreign guests to the local police. Where a Module facilitates the fulfilment of a sector-specific obligation — for example the automatic export of a foreign-guest register to the local police station — the Module's documentation identifies the applicable rule and the format expected by the relevant authority. Where the sector-specific rule requires additional retention or additional data flows, we implement them within the framework of the Law on Cybersecurity and of Decree 13.

§ 13Interaction with the E-Transactions Law 2023 and e-invoicing

The Law on E-Transactions 2023 (Luật Giao dịch điện tử 2023) governs the enforceability of electronic contracts, electronic signatures, and electronic records. Together with Decree 123/2020/ND-CP and Circular 78/2021/TT-BTC on e-invoicing, it forms the backbone of the digital commercial relationship between SiteminderStore and its Customers. Our infrastructure is configured to generate every invoice as a signed electronic invoice (hoá đơn điện tử), to transmit it to the General Department of Taxation (Tổng cục Thuế) through our accredited service provider, and to archive it for the statutory ten years.

§ 14Amendments

Vietnam's cyber-security framework is evolving. Draft amendments to the Law on Cybersecurity and successor decrees have been circulated for public consultation. Our compliance committee tracks these drafts and updates this page whenever a new implementing text is published in the Official Gazette. Where a change materially affects our Customers we notify account owners by e-mail at least thirty days before the change takes effect.

§ 15Contact

For any question about our compliance with the Law on Cybersecurity 2018 please write to dpo@siteminderstore.org and mark the subject "Cybersecurity Law". For urgent security matters — a suspected incident, a takedown request, an inquiry from A05 — please use security@siteminderstore.org. Both inboxes are monitored around the clock by the SiteminderStore security-operations team.

§ 16Independence from SiteMinder Limited

SiteminderStore Vietnam Company Limited is an independent Vietnamese company. It is not affiliated with, sponsored by, or endorsed by SiteMinder Limited. The Modules we distribute integrate with the Customer's SiteMinder Workspace through the official SiteMinder Application Programming Interface and work alongside the SiteMinder Workspace; they do not replace SiteMinder. Compliance with the Law on Cybersecurity is a responsibility that SiteminderStore assumes in its own right, independently of any obligation SiteMinder Limited may have under its own regulatory regime.