Policy status: Approved and actively followed. We use documented change approval, protected production baselines and rollback procedures. Effective April 11, 2026.
Purpose and scope
We ensure all production changes are risk reviewed, reversible and compatible with continuously operating messaging services.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- Every production change requires ticket, purpose, affected components, risk, backout plan, test evidence, time window, communications and named approver; emergency changes are logged retroactively within one business day.
- We protect the established production baseline for SMPP customer and supplier binds, message acceptance, queues, routing/LCR/fallback, filter scopes and overrides, DLR, billing/settlement and retry behaviour. Changes to these services require explicit authorisation.
- We perform unit/integration regression and smoke tests relevant to touched code, rollback readiness and observation period; compare TPS/bind/retry/DLR before and after any authorised release.
- We analyse application, database, storage, reverse-proxy, website and supplier changes separately. Website policy updates are handled independently of permissions to change the live messaging environment.
- We require peer review for privileged/high-risk security configuration, vendor-approved partner notice where necessary, and explicit release approval from owner.
- We retain controlled change evidence, and our approved release-closeout process updates architecture records, inventories, runbooks and the risk register.
Review and responsibility
Per change; monthly retrospective of emergencies and high-risk changes.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.