Cryptography, Secrets and Encryption Key Management

Policy status: Approved and actively followed. We apply cryptographic safeguards, access controls and key management practices. Effective April 11, 2026.

Purpose and scope

We use proportionate cryptographic protection for data in transit, at rest, and in credentials and backup paths.

This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.

Controls and practices in operation

1. We maintain a current cryptographic-controls inventory for HTTPS, APIs, SMPP, VPNs, storage, exports, mail, endpoints and backups, documenting how native TLS, network controls and data-at-rest safeguards apply to each environment.
2. Our active transport-security standard applies TLS 1.2 or stronger to supported sensitive web and API connections and uses documented partner-specific safeguards for existing SMPP connections whose transport differs.
3. We store passwords as salted adaptive hashes where protocol compatibility allows and protect secrets, private SSH keys and encryption keys against exposure in repositories, public documents and audit spreadsheets.
4. We maintain key and secret ownership, approved secure storage, access limitations, usage records, rotation triggers, recovery procedures and incident revocation. Each secret is governed by the protections actively used for its environment.
5. We protect backup archives and restricted exports through approved repository or storage safeguards and maintain records of the encryption and access protections actually in use, including offsite storage.
6. We review certificate expiry, algorithm compatibility and cryptographic exceptions quarterly. Any authorised legacy partner connections are governed by documented compensating controls, named owners and periodic risk reviews.

Review and responsibility

Quarterly cryptographic inventory/key reviews; on new integration/incident.

Accountability and reporting

Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.