This Policy describes the organisational and technical measures applied by ALINA VARAVA PR BEOGRAD (MB: 68859174; PIB: 116053265; address: DEČANSKA 8, SPRAT 2, BEOGRAD (STARI GRAD), SRBIJA) (the "Provider") when providing Kitten Servers services to protect confidential information, customers' personal data and cardholders' payment details. Card details are processed by the payment provider in accordance with the PCI DSS standard.
1. Confidential information
Confidential information includes customers' personal data (email, IP address, order and support request details), credentials for access to rented servers, payment IDs, and service secrets (keys, access tokens). Full bank card details never enter the Provider's systems.
2. Handling cardholder data
Bank card details (number, expiry date, security code) are entered by the cardholder only on the secure payment page of a PCI DSS-certified payment provider. They are transmitted over an encrypted channel (TLS) directly to the payment provider, bypassing the Provider's servers. The Provider only has access to the payment ID and its status.
3. Protection in transit
All data exchange between the user's browser and the website uses HTTPS (TLS 1.2 or higher). Internal service components are not directly accessible from the internet. Communication with the payment infrastructure takes place over secure channels with authentication of every request.
4. Protection at rest
We follow the principle of data minimisation: only data necessary to provide the service is collected and stored. Passwords are stored only as cryptographic hashes. Access to servers is restricted to authorised persons and uses cryptographic keys. Backups are made and protected at least to the same level as the original data.
5. Organisational measures
Access to confidential information is granted on a least-privilege basis. Secrets are stored separately from source code in a protected configuration. Server software is updated regularly. Significant security events are logged; public website forms are protected against abuse.
6. Incident response
When an incident is detected, it is contained, its scope assessed and its causes eliminated. If an incident affects personal data, affected users and, where applicable, the competent authorities are notified within the time limits set by applicable law.
7. User obligations
Users must keep their server credentials secret, not share them with third parties, and report any suspected compromise to [email protected] immediately. Actions performed with a user's valid credentials are deemed to have been performed by the user until such a report is made.
8. Vulnerability reports
Reports of vulnerabilities are accepted at [email protected] (subject "Security") and handled with priority. We appreciate responsible disclosure and take no action against good-faith researchers.
Information security questions: [email protected]