# Security procedures ___ These operational procedures are for account administrators and security teams. Use them to share confidential information, transfer files securely, request authorization for security testing, and manage credentials internally. These procedures complement the [Security best practices](https://www.infobip.com/docs/developer-resources/security/security-best-practices), which cover how to build a secure integration. ___ ## Share confidential information Never send credentials, tokens, or other secrets in plain text over email, chat, or other everyday channels. Use [S-PASS](https://s-pass.app/), an Infobip app for sharing confidential information. Shared information is readable only once, after which it is permanently erased. ### Store a secret [#store-a-secret-share-confidential-information] 1. Access S-PASS and select **Write a secret note**. 2. Write or paste the secret note. Choose how long it remains stored: until read, or until the storing time elapses. Then select **Store secret**. 3. Copy the token or the direct link from the **Secret stored!** dialog and share it with the recipient. NOTE Anyone with the token can access your secret note during the specified time frame. Until viewed, the information is encrypted and unreadable to everyone. ### Read a secret [#read-a-secret-share-confidential-information] If you have a direct access link, paste it into a browser to view the secret. If you have an access token, go to S-PASS, select **Read a secret note**, paste your token, and select **Submit token**. Once read, the secret note is deleted from the system. ___ ## Secure file transfer For exporting reports, use SFTP rather than unencrypted FTP. **FTP:** Transfers credentials and data payload over public networks in clear text, posing a high risk of unauthorized access. Use it only with extremely trusted, isolated systems, which is not applicable to any Infobip use case. **SFTP:** Implement an SFTP server on the client side and provide access parameters through the Infobip web interface Export feature or through [Support](https://www.infobip.com/contact). Follow these guidelines for a secure SFTP implementation: - Specify a non-standard port (other than 22). - Safelist the Infobip IP addresses for your location, listed in [Report export IPs](https://www.infobip.com/docs/developer-resources/security/ip-address-safelist#report-export-ips). - Use dedicated credentials for each client user, dedicated solely for Infobip. - Choose long, complex passwords (12 characters minimum). - Change passwords every 3 months. Beyond security, encrypted data transfer is a regulatory compliance requirement in many industries. IMPORTANT When you choose the insecure version of FTP, you accept the related security risks. Infobip renounces any liability that may result from such use. ___ ## Authorization to perform security testing The requirement to obtain authorization before any security testing is a binding obligation. This section describes the procedure for requesting that authorization. Infobip conducts regular external penetration tests using third-party companies and the following methodologies: - OSSTMM (Open Source Security Testing Methodology Manual) - OWASP (Open Web Application Security Project) - NIST penetration testing and audit methodologies, including automated and manual techniques Infobip provides detailed reports of these exercises to clients and partners upon a signed NDA and within the scope of the contracted services. If those reports are not sufficient, penetration testing or vulnerability scanning of the Infobip environment may be arranged according to the [service terms and conditions](https://www.infobip.com/policies/service-terms-conditions). The client or partner must agree to share testing findings with the Infobip Corporate Security team. Especially severe or critical issues must be reported without delay. IMPORTANT Third parties are not authorized to perform any security testing of Infobip endpoints or those of its affiliates without prior approval from Infobip. Third parties may not disclose any findings without a prior contractual agreement or approval. Every external security testing activity must be announced. Send a request to your account manager or [Support](https://www.infobip.com/contact). Approved requests must comply with the requirements documented in the External Penetration Testing Document provided by Infobip Corporate Security. Under the NDA, the client is responsible for protecting the confidentiality of any vulnerabilities found. If penetration testing discovers vulnerabilities in the Infobip system, Infobip Corporate Security triages the findings. Proof of remediation is provided to the requesting third party. ___ ## Report a vulnerability To report a security vulnerability in a public Infobip product, domain, API, or service, use the Infobip Coordinated Vulnerability Disclosure (CVD) program. Email [bugbounty@infobip.com](mailto:bugbounty@infobip.com) to request access to the Infobip bug bounty program on Bugcrowd. The [CVD policy](https://www.infobip.com/security-trust-center/cvd-policy) lists the information to include, the scope, and how Infobip handles reports. You can also contact [security@infobip.com](mailto:security@infobip.com). Do not disclose the vulnerability to third parties until Infobip gives written permission and deploys a fix. Denial-of-service attacks, social engineering, and automated scanning without prior written approval are out of scope. ___ ## Client internal processes Reinforce internal credential storage and management to reduce the risk of internal data leakage. A leak can lead to unauthorized access to the Infobip platform and traffic costs. For safekeeping of passwords, consider using a commercial-grade password management tool. ___ Related pages [Security best practices](https://www.infobip.com/docs/developer-resources/security/security-best-practices) Guidelines for securing API integrations authentication traffic encryption credential storage and AIT prevention. [REST API traffic encryption](https://www.infobip.com/docs/developer-resources/security/rest-api-traffic-encryption) How Infobip encrypts REST API traffic with TLS and manages certificate and cipher suite changes. [IP address safelist](https://www.infobip.com/docs/developer-resources/security/ip-address-safelist) The IP address ranges to safelist for messaging sFTP report exports media streaming WebRTC and public cloud traffic.