We welcome good-faith reports of security or privacy concerns involving Pingplus Media services.
How to report
Policy status: Approved and in effect. Pingplus Media maintains this policy as an active part of its established governance and daily operating practices. Effective April 11, 2026.
Use our contact form with the subject Security / Privacy Incident. Describe the relevant service, approximate time, a concise observation, and a safe contact method. Please minimise personal data, do not submit OTPs, passwords or API keys, and do not include another person's message content without authorisation.
Safe disclosure
Do not carry out denial-of-service activity, spam, live SMPP bind tests, data exfiltration, social engineering, persistence, destructive attacks or intrusive scanning without prior written permission. Stop and report if a suspected vulnerability could expose data.
Our response
Reports are assessed and escalated to the appropriate operational owner. Containment, investigation, customer communication and any regulatory or contract-specific notifications follow the circumstances, applicable laws and signed customer agreements. We do not make a universal external notification-time guarantee independent of those obligations.
If immediate service disruption is suspected, use the support route specified in your enterprise agreement.
What to report
A security incident report may involve account takeover, unauthorised access, exposed credentials, malicious message submission, inappropriate disclosure of recipients or message metadata, malware, suspicious infrastructure activity or loss of a critical system. For urgent operational outages, use existing support or contractual incident channels in parallel with this website contact route.
Initial intake and triage
Report when it happened, the affected service or account, observable symptoms and a safe way for our team to reply. Do not paste live customer messages, authentication tokens, passwords, OTPs, private keys or full database extracts into the contact form. The designated operations or security lead classifies confidentiality, integrity, availability and regulatory impact before assigning investigators.
Response stages
Incident handling follows a general lifecycle: preparation; detection and identification; classification and escalation; containment compatible with essential services; investigation and evidence preservation; recovery; and documented lessons learned. Isolating critical production components, suspending partner traffic or modifying SMPP connections requires a proportional decision and explicit operational authorisation rather than an automatic website-driven action.
Notification and confidentiality
For incidents affecting a customer, communications are coordinated through the appropriate contractual contacts and applicable legal reporting requirements. Updates address known impacts and relevant protective or recovery measures.
Post-incident correction
The incident owner records the event timeline, affected assets, root cause where known, business impact, communications, corrective actions and owner/due date. Any corrective technical change affecting customer routing, storage, authentication or connection interoperability follows the production change approval process, with monitoring and closure evidence retained confidentially.
For questions about this policy or enterprise service requirements, please contact our team.