Policy status: Approved and actively followed. We protect our production network and SMPP connectivity using controlled credentials and approved changes. Effective April 11, 2026.
Purpose and scope
We protect customer/supplier connectivity and network boundaries without unexpectedly breaking live SMS delivery.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We maintain an inventory of external-facing services, owners, protocols, business purposes and authorised peers, including a distinction between host bind addresses and verified internet exposure.
- We maintain documented network restrictions for administrative and partner access. We protect existing approved customer and supplier IP ranges during network changes through verified inventory, staged evaluation and change approval.
- Our approved partner-transport security controls use TLS 1.2 or stronger, VPN or restricted network connections where appropriate to the active service. Any authorised legacy transport exception is documented with network safeguards, a responsible owner and periodic review.
- We manage customer-specific SMPP allowlists using explicit, validated entries and scheduled reviews. Changes involving legacy or empty allowlist handling are performed through a compatibility review and controlled rollout.
- We protect web applications using the configured reverse proxy and supporting security controls, and review SMPP abuse through operational monitoring and alerting. We describe supplementary monitoring capabilities according to their active configuration.
- We review TLS certificates, management ports, DNS and permitted service protocols at least quarterly and after material changes; store topology and allowed endpoints in restricted inventories.
- No live SMPP port, bind, route, LCR, content filter, billing, queue or DLR behavior may be altered by the audit or by document approval alone.
Review and responsibility
Quarterly firewall/allowlist/protocol reviews; before every new connection/change.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.