Policy status: Approved and actively followed. We classify and protect company, customer and messaging data using access and handling controls. Effective April 11, 2026.
Purpose and scope
We maintain a documented understanding of the data we process, its owners and classification, and how it is stored, used, shared and securely disposed of.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We maintain an asset/data register covering source code, SMPP accounts, message bodies, OTPs, sender IDs, DLRs, analytics, invoices, API logs, customer contact data, laptops, APP/DB hosts, storage and suppliers.
- We classify information as Public, Internal, Confidential or Restricted. OTP content, credentials/private keys, security logs with PII, customer delivery data and message archives are Confidential or Restricted unless formally classified otherwise.
- We enforce role-based access to classified information and apply approved OTP and personal-data masking protections across supported interfaces, support workflows and logs. Any applicable technical exceptions are formally tracked with compensating safeguards.
- We maintain data-handling rules for Public, Internal, Confidential and Restricted information, including defined access approval, data minimisation, secure transfer, retention and appropriate handling of technically constrained systems.
- We protect classified electronic media and backups with approved secure transfer, access restrictions, supported encryption controls and documented disposal procedures. Encryption status is represented according to the actual repository and storage configuration.
- We protect classified electronic media and backups through controlled transfer, access protection and supported encryption. Repository-level and storage-level encryption are described accurately according to their configuration.
Review and responsibility
Inventory annually and on asset onboarding; retention register reviewed annually and for new customer contracts.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.