Security practices

The public website, account tools, cloud platform, rented servers and colocation facilities are different systems. A security control described for one is not automatically a control or certification for all of them.

The measures that form part of a contracted service are described in its order, security schedule and, where applicable, the Data Processing Agreement. This page does not replace those commitments or establish a separate uptime, incident response or recovery guarantee.

Our public website uses encrypted HTTPS connections in production. Protected checkout sessions use signed cookies and server-side authorisation checks to help prevent access to another person's order. Session cookies are configured to restrict script access and transmission over unencrypted connections where appropriate.

Website forms use measures intended to reduce automated abuse. Access to website data and credentials is limited to authorised systems and personnel. Production secrets must remain outside public website code and public repositories.

These controls reduce risk but do not make an account or website immune to compromise. A signed cookie is not encryption of all stored data, and HTTPS on the website does not mean every customer workload or network circuit is automatically encrypted.

Use individual accounts, least-privilege permissions and multifactor authentication where available. Keep recovery contacts current, protect API keys, remove unused access and install security updates on systems you control. If a required account control is not available, discuss alternatives before deploying a workload that depends on it.

Backups, replication and disaster recovery are included only when expressly stated in your order. A redundant platform, RAID array, snapshot or availability SLA does not by itself promise that lost or deleted data can be recovered.

Choose backup frequency, retention and geographic separation that match your business needs, and test restoration. Recovery time and recovery point commitments apply only if expressly agreed. Maintain an independent copy of important data where appropriate.

The datacenter and connectivity availability commitment is described in the Terms of Service, Appendix A. It is separate from data confidentiality, integrity and recovery obligations.

The accepted order identifies where the contracted workload is hosted. Support access, administration, billing and optional replication may involve different locations; the relevant processing and transfer arrangements must be recorded in the service documents and DPA.

A facility operated by a third party may have its own certifications. A facility certificate does not automatically certify Conexum Inc., the IPXON cloud platform or a customer's application. Ask for the issuer, scope, covered site, validity period and applicable report before relying on a certification.

For a security assessment, request the service-specific control schedule and available assurance materials through noc@ipxon.com. Confidential materials may require appropriate confidentiality arrangements. We do not promise a certification, report or assessment that has not been issued for the relevant scope.

If your workload requires regulated-data handling, dedicated key management, a specific residency restriction or an additional agreement, raise that requirement before deployment. Purchasing infrastructure alone does not certify your application or establish compliance with every sector-specific obligation.

If you suspect compromise of an IPXON account or service, contact noc@ipxon.com and use support@ipxon.com for an active service incident. Include an affected service identifier and a safe contact method, but do not send passwords or private keys.

Where a personal data breach affects information we process on a customer's behalf, notification and cooperation follow the DPA. Where we are responsible for our own personal data processing, we follow applicable notification requirements. A routine blocked scan does not necessarily constitute a personal data breach.

During an investigation, we may need to isolate an affected resource, rotate credentials or preserve relevant evidence. We will coordinate where practicable and limit measures to what the circumstances reasonably require. You should preserve relevant logs under your control and tell us about actions that could affect the investigation.

Send a private report to noc@ipxon.com. Include the affected IPXON-controlled domain or service, a description of the issue, safe reproduction steps, likely impact and your reply address. Ask for a secure transfer method before sending sensitive evidence.

Use your own test account and stop once you have enough information to demonstrate the issue safely. Do not access, modify, retain or disclose other people's data; attempt persistence; use social engineering; disrupt availability; or test customer workloads, suppliers or other third-party systems without their permission. If you encounter unintended access, stop and report it.

We welcome good-faith reports. For research limited to IPXON-controlled systems that follows this guidance, we will not pursue legal action solely because the research revealed a vulnerability. This statement cannot authorise activity on third-party systems or bind third parties or public authorities. Contact us before a test if its scope or safety is uncertain.

We aim to acknowledge a report within three business days and provide an initial status within ten business days. These are communication targets, not guaranteed remediation deadlines. We will agree a reasonable disclosure timetable based on risk and remediation progress; we do not require indefinite silence. No reward or bounty is promised unless a separate programme expressly offers one.

See the Fair Usage Policy for permitted testing and abuse handling, the Privacy Policy for our own processing, and the DPA for customer-hosted personal data.

Security and vulnerability reports: noc@ipxon.com. Abuse reports: abuse@ipxon.com. Provider: Conexum Inc., 3250 W Commercial Blvd, Suite 140, Fort Lauderdale, FL 33309-3459, United States.