Policy status: Approved and actively followed. We use supplier security oversight, due diligence and contract-based data protection controls. Effective April 11, 2026.
Purpose and scope
We manage supplier and messaging-chain subcontractor security through established roles, contracts, due diligence and ongoing oversight.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We maintain an approved list of suppliers and sub-aggregators: identity, services, data handled, hosting location, criticality, shared routes, security contact, start/termination and current due-diligence status.
- We require executed confidentiality, appropriate data-protection and security obligations before disclosing client data or enabling supplier production traffic, subject to legal approval.
- We conduct supplier due diligence and annual risk-based reassessments of critical suppliers, covering corporate identity, incident contacts, access boundaries, certification representations and subcontracting scope.
- We document each contracting party’s data protection role and applicable subprocessor commitments as agreed in executed customer contracts and data-processing agreements.
- We notify customers of material subprocessor changes only to the extent promised by signed agreements and applicable law; retain notice records.
- We ensure removal of partner access and secure contract/data closeout when supplier relationships end, without inadvertently deleting required records or breaking live customer routes.
Review and responsibility
At supplier onboarding; annually critical reviews; at material supplier/contract changes.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.