Policy status: Approved and actively followed. We maintain our VAPT governance, approved testing procedures and remediation-tracking process. Effective April 11, 2026.
Purpose and scope
We conduct safe and purposeful security testing and close validated weaknesses without harming SMS production.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We maintain an internal and external vulnerability assessment and penetration-testing programme covering the applicable network, application and SMPP protocol scope, with annual and material-change review cycles and approved testing windows.
- We prohibit unauthorised active scanning, SMPP binds, fuzzing, traffic spikes, message submissions, route tests, stress tests, credential guessing and firewall probing on live production.
- We use qualified, authorised security testers with documented scope, methodology, limits, exclusions, escalation contacts and stop criteria, independent of the change implementers wherever feasible.
- We track security-test findings by severity, affected asset, responsible owner, action date and remediation evidence, and arrange validation testing for closures.
- We provide customers with assessment and remediation status only in accordance with contracted disclosure terms, protecting source code, secrets and sensitive network details.
- We treat host assessments, web application testing and SMPP-protocol testing as distinct testing streams, each with its own stated coverage.
Review and responsibility
At least annually or after material changes; monthly open finding review.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.