Information Security Policy
Last updated: October 2026
This Policy describes the organizational and technical measures S³OTA applies to protect confidential information, customers' personal data and cardholders' payment details during their transfer, processing and storage. The measures take into account Art. 18.1 and 19 of Federal Law No. 152-FZ "On Personal Data"; card details are processed by the payment service in accordance with the Payment Card Industry Data Security Standard (PCI DSS).
1. Confidential information
Confidential information includes: customers' personal data (email, IP address, order and support request details), access credentials for rented servers, payment identifiers, and the service's own secrets (keys, access tokens). Full bank card details are not part of the information processed by the service — they never reach S³OTA systems.
2. Processing of cardholder details
Bank card details (number, expiry date, verification code) are entered by the cardholder exclusively on the secure payment page of a PCI DSS-certified payment service. The details travel over an encrypted channel (TLS) directly to the payment service, bypassing S³OTA servers. The service only receives the payment identifier and its status; full card details and verification codes are not stored by S³OTA and cannot technically be stored by it.
3. Protection of data in transit
All data exchange between the user's browser and the website uses HTTPS (TLS 1.2+). Internal components of the service (API, database) are not directly reachable from the Internet: they accept connections only on the server's local interface behind a reverse proxy. Service-to-service communication with the payment infrastructure uses secure channels with per-request authentication.
4. Protection of data at rest
Data minimization applies: only the data necessary to provide the service is collected and stored (section 2 of the Personal Data Processing Consent). Passwords are stored exclusively as cryptographic hashes (bcrypt) and cannot be recovered in their original form. The database is unreachable from the public network; server access is limited to authorized personnel using cryptographic keys. Backups are made and protected at a level no lower than the original data.
5. Organizational measures
Access to confidential information follows the least-privilege principle and is granted only to those who need it for their duties. Secrets (keys, tokens, service passwords) are kept separately from the source code in protected configuration. Server software is updated regularly. Significant security events are logged; public website forms are rate-limited to prevent abuse and enumeration.
6. Incident response
When an information security incident is detected, it is contained, assessed and remediated. For incidents affecting personal data, affected users and, where applicable, the authorized bodies are notified within the timeframes established by law (including Art. 21(3.1) of Federal Law No. 152-FZ).
7. User responsibilities
The user must keep the received server access credentials secret, not share them with third parties, and immediately report any suspected compromise to support@sssota.com. Operations performed with the user's valid credentials are deemed performed by the user until such a report is received.
8. Vulnerability reports
Reports of discovered vulnerabilities and security incidents are accepted at support@sssota.com (subject "Security") and handled with priority. We appreciate responsible disclosure and take no action against good-faith researchers who act without harming users or the service.
Information security enquiries: support@sssota.com