Effective Date: August 14, 2026
1. PURPOSE AND SCOPE
1.1. Introduction. This document ("Security Commitments") describes the commercially reasonable technical and organizational measures (TOMs) implemented by the Pinkdude Group ("Provider") to protect the confidentiality, integrity, and availability of Customer Data and the Platform Infrastructure.
1.2. Shared Responsibility Model. Security is a shared responsibility between the Provider and the Customer.
Provider Responsibility ("Security OF the Cloud"): The Provider is responsible for protecting the infrastructure that runs the Services (hardware, software, networking, and facilities).
Customer Responsibility ("Security IN the Cloud"): The Customer is responsible for managing their data (including encryption options), classifying their assets, and using Identity and Access Management (IAM) tools to apply appropriate permissions.
1.3. No Absolute Security. While the Provider implements robust safeguards designed to protect Customer Data, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.
1.4. Legal Disclaimer. The Security Commitments described herein are provided for informational purposes only and do not constitute a contractual guarantee of specific security outcomes or prevent all possible security breaches.
2. PHYSICAL SECURITY
2.1. Data Centers. We host our infrastructure in industry-standard data centers located in the regions specified in the Platform Framework (Document 0). These facilities employ layered physical security controls which may include:
(a) Perimeter Defense: Physical barriers, controlled access points, and professional security personnel.
(b) Access Control: Multi-factor authentication mechanisms (e.g., badges, biometrics) and strict visitor logging protocols to ensure only authorized personnel enter the facility.
(c) Surveillance: 24/7 video surveillance of entry points and server rooms.
2.2. Environmental Controls.
(a) Power: Redundant power systems (UPS and backup generators) designed to ensure continuous operation.
(b) Climate: Industry-standard HVAC systems to maintain optimal temperature and humidity.
(c) Fire Suppression: Automated fire detection and suppression systems designed to protect hardware from damage.
3. NETWORK SECURITY
3.1. Perimeter Protection.
(a) DDoS Mitigation: We utilize automated scrubbing centers and traffic analysis tools designed to mitigate volumetric attacks (L3/L4) to protect platform availability.
(b) Firewalls: We deploy network security controls (e.g., firewalls, security groups) at the edge to filter unauthorized traffic.
3.2. Encryption.
(a) Data in Transit: We implement strong encryption protocols (such as TLS 1.2 or higher) for data transmitted between the Customer and the Services.
(b) Data at Rest: Customer Data stored in Block Storage or Object Storage is designed to be encrypted at rest using industry-standard algorithms (e.g., AES-256).
3.3. Vulnerability Management.
(a) Automated Scanning: We perform periodic vulnerability assessments of our public-facing infrastructure to identify potential weaknesses.
(b) Penetration Testing: We engage independent third-party security firms to conduct penetration tests on a regular basis. (Summary reports may be made available to Enterprise Customers upon request under NDA).
4. ACCESS CONTROL (IAM)
4.1. Internal Access (Provider Staff).
(a) Least Privilege: Access to production systems is limited to authorized personnel with a legitimate business need.
(b) Multi-Factor Authentication (MFA): We enforce MFA for internal access to administrative consoles and VPNs.
(c) Audit Logging: Administrative actions are logged in accordance with internal security policies for security review and auditing purposes.
4.2. Customer Access.
(a) Authentication: Customers access the Services via secure credentials. We support (and strongly recommend) the use of MFA/2FA for all Customer accounts.
(b) API Security: API access is secured via unique API Tokens. Tokens can be scoped and revoked by the Customer at any time.
5. INCIDENT RESPONSE
5.1. Response Function. We maintain an incident response function designed to detect and respond to security events affecting the Platform.
5.2. Notification. In the event of a confirmed Security Incident involving the unauthorized disclosure of Customer Data, we will notify affected Customers without undue delay and in accordance with applicable law via email or the Customer Dashboard.
5.3. Process. Our Incident Response procedures typically include detection, containment, remediation, and root cause analysis.
6. BUSINESS CONTINUITY & DISASTER RECOVERY (BC/DR)
6.1. Backups.
(a) Control Plane: We perform regular automated backups of our internal control plane databases.
(b) Customer Responsibility: Unless utilizing a specific "Managed Backup Service," Customers are solely responsible for configuring and maintaining their own backup schedules for their data, Virtual Machines, and Storage.
6.2. Redundancy. Our infrastructure is designed for high availability. Where available, core services are deployed across multiple Availability Zones (AZs) to enhance resilience against single data center failures.
7. UPDATES TO SECURITY PRACTICES
7.1. Right to Modify. The Provider reserves the right to modify these Security Commitments and its underlying security measures from time to time to reflect evolving industry practices, technological developments, and threat landscapes, provided that such modifications do not materially degrade the overall security of the Services.
8. COMPLIANCE
8.1. Audits. To maintain the security of our multi-tenant environment, the Customer agrees not to conduct physical audits of the Provider’s data centers. Upon request (Enterprise Tier only), the Provider may supply:
(a) Applicable third-party audit reports (e.g., SOC 2, ISO 27001) or bridge letters.
(b) Security questionnaires completed by our team.
8.2. Law Enforcement. We review all law enforcement requests to ensure they are valid and legally binding before disclosing any Customer Data. We attempt to notify Customers of such requests unless prohibited by law.