Policy status: Approved and actively followed. We follow secure development, code-review, testing and release-protection practices. Effective April 11, 2026.
Purpose and scope
We integrate security throughout the engineering lifecycle and preserve backward compatibility with approved telecommunications integrations.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We protect source repository access using role approval, independent code review for critical changes, MFA where supported and secrets scanning before merge.
- We apply documented design security reviews across API authentication, tenant separation, privileged access, content controls, SMPP authentication, callbacks and message archives, including abuse-case analysis.
- We operate dependency review and static analysis where supported by the development environment. Security findings are assessed before release and any accepted exceptions remain owned and time-bound.
- We validate authentication, authorisation, CSRF/cookie security, input size/bounds, webhook authenticity, logging privacy and rate limiting in staged automated/manual tests.
- We preserve existing partner compatibility: no change to routing/LCR, message acceptance, SMPP login, DLR, billing, content-filter precedence or worker jobs without explicit owner-approved phased release.
- We apply repeatable deployment, rollback and objective regression criteria to security hotfixes. Release approval includes the required testing and operational readiness checks.
Review and responsibility
At code review/release; quarterly secure-coding backlog review.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.