Incident Response, Evidence Handling and Breach Notification

Policy status: Approved and actively followed. We use an active security-incident response and escalation process. Effective April 11, 2026.

Purpose and scope

We provide repeatable triage, containment, investigation, recovery and contractual/legal notification without disrupting evidence or services unnecessarily.

This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.

Controls and practices in operation

1. We maintain an incident response team roster: Incident Commander, Technical Responder, Privacy/Legal Lead, Communications Lead and backup persons, including out-of-hours contact routes.
2. Employees follow an established incident-reporting policy and promptly report suspected security or privacy events through designated channels. The incident lead records case identity, detection time, severity, scope, response actions, notifications and controlled evidence.
3. The incident team conducts prompt severity triage, targets internal escalation within one hour for potentially severe incidents, and protects incident evidence using restricted and integrity-controlled records.
4. We notify customers and relevant business partners in accordance with executed contracts, data-protection terms and applicable law. Contract-specific priority notification procedures, including 24-hour workflows where applicable, are maintained by the incident team.
5. Containment changes that affect production messaging, SMPP binds, billing or routes require Incident Commander approval and a service-impact decision; emergency actions are logged and reviewed afterward.
6. We perform an annual tabletop simulation and post-incident lessons-learned review; record exercise scope, attendance, detection-to-decision time and improvement actions.
7. We use a legal/privacy review before customer data disclosures, regulator reports or media communications.

Review and responsibility

At each incident; annual exercise; contacts reviewed quarterly.

Accountability and reporting

Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.