Security Policy

Our Commitment to Security

At Suzko, security is foundational to everything we do. We understand that our customers trust us with their data and applications, and we take that responsibility seriously. This policy outlines our security practices, infrastructure protection measures, and how we handle security vulnerabilities.

Infrastructure Security

Physical Security

Our data centers feature enterprise-grade physical security measures:

• 24/7/365 on-site security personnel
• Biometric access controls and multi-factor authentication
• Video surveillance with extended retention
• Mantrap entry systems
• Visitor logging and escort requirements
• Perimeter fencing and intrusion detection systems

Network Security

We implement multiple layers of network protection:

• Enterprise-grade firewalls with intrusion prevention
• DDoS mitigation with multi-terabit capacity
• Network segmentation and VLANs
• Regular penetration testing and vulnerability assessments
• 24/7 network monitoring and alerting
• BGP route filtering and traffic analysis

Server Security

All servers are hardened according to industry best practices:

• Regular security patches and updates
• Minimal attack surface (unnecessary services disabled)
• Host-based intrusion detection
• Anti-malware and rootkit detection
• Secure boot and firmware integrity verification
• Automated vulnerability scanning

Data Protection

Encryption

Access Controls

• Role-based access control (RBAC) for all systems
• Principle of least privilege enforced
• Multi-factor authentication required for all administrative access
• Regular access reviews and certification
• Privileged access management with session recording
• Automatic account lockout after failed attempts

Data Handling

• Data classification and handling procedures
• Secure data disposal and sanitization
• Encryption key management with hardware security modules
• Regular backup testing and verification

Application Security

Secure Development

Our development practices include:

• Security training for all developers
• Secure coding guidelines and code review
• Static and dynamic application security testing (SAST/DAST)
• Dependency vulnerability scanning
• Security requirements in design phase
• Pre-deployment security review

Customer Account Security

We provide multiple security features for customer accounts:

• Two-factor authentication (TOTP)
• Strong password requirements
• Login attempt monitoring and alerting
• Session management and timeout controls
• API key management with granular permissions
• Activity logging and audit trails

Operational Security

Personnel Security

• Background checks for all employees
• Security awareness training (initial and ongoing)
• Confidentiality agreements
• Access revocation upon termination
• Regular security policy acknowledgment

Incident Response

We maintain a comprehensive incident response program that includes:

• 24/7 security monitoring and on-call response team
• Documented incident response procedures
• Regular tabletop exercises and drills
• Post-incident analysis and improvement
• Customer notification within 72 hours of confirmed breach
• Coordination with law enforcement when appropriate

Business Continuity

• Redundant systems and failover capabilities
• Regular backup and disaster recovery testing
• Geographically distributed infrastructure
• Documented recovery procedures with defined RTOs and RPOs

Compliance and Certifications

We align our security practices with industry standards and frameworks:

• SOC 2 Type II (annual audit)
• ISO 27001 aligned practices
• PCI DSS compliant payment processing (via Stripe)
• GDPR and data protection regulations
• HIPAA-eligible infrastructure available upon request

Vulnerability Disclosure Program

Reporting Security Issues

We appreciate the security research community's efforts in helping keep our services secure. If you discover a security vulnerability, please report it to us responsibly.

Report vulnerabilities to: security@suzko.com

Please include:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Any proof-of-concept code (if applicable)
• Your contact information for follow-up

Our Commitment

When you report a vulnerability to us, we will:

• Acknowledge receipt within 24 hours
• Provide an initial assessment within 5 business days
• Keep you informed of our progress
• Credit you in our security acknowledgments (if desired)
• Not take legal action against good-faith researchers

Scope

The following are in scope for our vulnerability disclosure program:

• suzko.com and all subdomains
• Customer portal and API
• Control panel integrations

The following are out of scope:

• Third-party services and integrations
• Social engineering attacks
• Physical attacks
• Denial of service attacks
• Customer data or systems

Security Updates

We continuously improve our security posture. Major security updates and advisories are communicated through:

• Service status page notifications
• Email to affected customers
• In-portal announcements

Contact Information

For security-related inquiries, please contact us at:

Last updated: January 16, 2026