Policy status: Approved and actively followed. We oversee hosting security, access restrictions and physical-security responsibilities with our providers. Effective April 11, 2026.
Purpose and scope
We ensure hosting facilities and managed service providers meet requirements commensurate with their physical and logical access roles.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We maintain a controlled hosting and infrastructure inventory covering application, database and backup hosts and website providers, along with supplier and administrative access boundaries. Sensitive host details are held in restricted records.
- We maintain provider security assurance and contractual records addressing facility access, infrastructure resilience, physical safeguards and provider personnel controls to the extent available for each supplier.
- We record division of responsibility for firewall, hypervisor, OS patching, media disposal, remote hands, monitoring, DNS and certificate administration.
- We prohibit unauthorized administrative access to production hosts; maintain dedicated recovery and audit identities with documented rights and periodic review.
- We assess primary-site and backup-location dependencies as part of our active recovery governance and document the actual independent storage, access restrictions and recovery arrangements in use.
- We review hosting, facility and provider dependencies annually and prior to material supplier changes, basing external resilience statements on currently configured and evidenced infrastructure.
Review and responsibility
Annually and at hosting/provider change.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.