Security Policy

The floor, not the upsell

Security is not a feature, it's the floor. Below is what we actually do — encryption in transit and at rest, biometric facility access, regular third-party audits, a vulnerability disclosure program at security@suzko.com — not what we wish were true.

Infrastructure Security

Physical Security

Our data centers feature enterprise-grade physical security measures:

• 24/7/365 on-site security personnel
• Biometric access controls and multi-factor authentication
• Video surveillance with extended retention
• Mantrap entry systems
• Visitor logging and escort requirements
• Perimeter fencing and intrusion detection systems

Network Security

We implement multiple layers of network protection:

• Enterprise-grade firewalls with intrusion prevention
• DDoS mitigation with multi-terabit capacity
• Network segmentation and VLANs
• Regular penetration testing and vulnerability assessments
• 24/7 network monitoring and alerting
• BGP route filtering and traffic analysis

Server Security

All servers are hardened according to industry best practices:

• Regular security patches and updates
• Minimal attack surface (unnecessary services disabled)
• Host-based intrusion detection
• Anti-malware and rootkit detection
• Secure boot and firmware integrity verification
• Automated vulnerability scanning

Data Protection

Encryption

Access Controls

• Role-based access control (RBAC) for all systems
• Principle of least privilege enforced
• Multi-factor authentication required for all administrative access
• Regular access reviews and certification
• Privileged access management with session recording
• Automatic account lockout after failed attempts

Data Handling

• Data classification and handling procedures
• Secure data disposal and sanitization
• Encryption key management with hardware security modules
• Regular backup testing and verification

Application Security

Secure Development

Our development practices include:

• Security training for all developers
• Secure coding guidelines and code review
• Static and dynamic application security testing (SAST/DAST)
• Dependency vulnerability scanning
• Security requirements in design phase
• Pre-deployment security review

Customer Account Security

We provide multiple security features for customer accounts:

• Two-factor authentication (TOTP)
• Strong password requirements
• Login attempt monitoring and alerting
• Session management and timeout controls
• API key management with granular permissions
• Activity logging and audit trails

Operational Security

Personnel Security

• Background checks for all employees
• Security awareness training (initial and ongoing)
• Confidentiality agreements
• Access revocation upon termination
• Regular security policy acknowledgment

Incident Response

We maintain a comprehensive incident response program that includes:

• 24/7 security monitoring and on-call response team
• Documented incident response procedures
• Regular tabletop exercises and drills
• Post-incident analysis and improvement
• Customer notification within 72 hours of confirmed breach
• Coordination with law enforcement when appropriate

Business Continuity

• Redundant systems and failover capabilities
• Regular backup and disaster recovery testing
• Geographically distributed infrastructure
• Documented recovery procedures with defined RTOs and RPOs

Compliance and Certifications

We align our security practices with industry standards and frameworks:

• SOC 2 Type II (annual audit)
• ISO 27001 aligned practices
• PCI DSS compliant payment processing (via Stripe)
• GDPR and data protection regulations
• HIPAA-eligible infrastructure available upon request

Vulnerability Disclosure Program

Reporting Security Issues

We appreciate the security research community's efforts in helping keep our services secure. If you discover a security vulnerability, please report it to us responsibly.

Report vulnerabilities to: security@suzko.com

Please include:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Any proof-of-concept code (if applicable)
• Your contact information for follow-up

Our Commitment

When you report a vulnerability to us, we will:

• Acknowledge receipt within 24 hours
• Provide an initial assessment within 5 business days
• Keep you informed of our progress
• Credit you in our security acknowledgments (if desired)
• Not take legal action against good-faith researchers

Scope

The following are in scope for our vulnerability disclosure program:

• suzko.com and all subdomains
• Customer portal and API
• Control panel integrations

The following are out of scope:

• Third-party services and integrations
• Social engineering attacks
• Physical attacks
• Denial of service attacks
• Customer data or systems

Security Updates

We continuously improve our security posture. Major security updates and advisories are communicated through:

• Service status page notifications
• Email to affected customers
• In-portal announcements

Contact Information

For security-related inquiries, please contact us at:

Last updated: January 16, 2026