Your business correspondence, website and customer data deserve considered protection. Here you can learn about access controls, backups, security updates and help when something goes wrong.
Protection starts with clear responsibilities
- Email: protected connections, message security checks and service-specific recovery options.
- Web hosting: server protection, separation of customer data and backups.
- Website maintenance: agreed software updates, monitoring and remediation.
- Your control: access to your data must be justified, limited and traceable.
Access only when the work requires it
The planned procedure provides for individual administrative accounts, multi-factor authentication for administrators and the minimum necessary permissions. Access to customer content must be based on a documented service requirement, customer instruction or legal obligation.
The need for support access and its use are recorded. Temporary permissions are removed when work is complete, and ongoing permissions are reviewed at least quarterly. Staff and partners are subject to confidentiality obligations.
Customer emails and service data must not be copied into public AI chats. For a separately ordered AI feature, the permitted data, service partner, retention and terms of use must be defined in advance.
Protecting your business correspondence
Qboxmail is Sibly's technical email partner. Activated security features and recovery scope depend on the selected Sibly package. A feature offered by a partner is not automatically included in every package.
- Protected connections. We require HTTPS for webmail and TLS for email client connections. Connection encryption does not mean end-to-end encryption of messages.
- Spam and malware checks. Automated filtering helps identify dangerous messages. The precise protection depends on the package; no filter detects every scam.
- Protection against forged messages in your company's name. Domain setup includes checking SPF, DKIM and DMARC. A stricter DMARC policy is applied after legitimate senders have been checked.
- Account protection. Administrator multi-factor authentication is planned as mandatory; user options and guidance are specified by package.
Recovering a deleted message
Qboxmail's Mail Time Machine provides access to daily mailbox snapshots up to 15 days old. Only messages present in a snapshot can be recovered: a message received and deleted between snapshots may not be recoverable. The recovery option for your package is defined in the service agreement.
Long-term email archiving is a separate service. Daily backups do not replace an archive; archive retention is agreed with the customer.
Partner documentation: Qboxmail Mail Time Machine.
Web hosting with a recovery plan
Hosting security covers the server environment, connections and backups. Maintaining the customer's website plugins and themes is part of a separate website maintenance service.
| Measure | What does it mean for you? |
|---|---|
| Protected connections and isolation | HTTPS, encrypted administration connections and separation of customers' files and databases. One customer's account must not provide access to another customer's data. |
| Daily backups | A copy of files, databases and required settings at least every 24 hours; target retention of recovery points is 30 days. |
| Backup protection | Permissions separated from production, encryption and protection against accidental or malicious deletion. |
| Recovery checks | A sample-site restoration test every month and a full technical environment recovery test every quarter. |
| Monitoring | Checks of service and backup jobs, with failure alerts. Automated monitoring is not the same as round-the-clock human coverage. |
Recovery time and potential data loss depend on website size and backup frequency. They are agreed based on tested capabilities. Online stores and sites with frequent transactions are assessed separately for more frequent backups.
Website maintenance keeps your software up to date
For contracted websites, the planned workflow includes WordPress, plugin and theme security updates, malware and vulnerability checks, and resolution of identified problems within the agreed scope.
A recovery option must exist before a major change. After an update, core website functions are checked, including forms and, where relevant, the checkout process. For incompatible or unsupported plugins, we propose a replacement or another remedy.
Planned patching targets are up to 24 hours for critical risks, 72 hours for high risks, 14 days for medium risks and 30 days for low risks after the fix is available and the affected system identified. Active attacks are contained immediately; temporary safeguards are used when no fix exists. These are implementation targets; binding service levels are defined in the service agreement.
A website audit helps identify areas for improvement. A trust mark and credit score describe a company's background; they are not technical website security certificates.
Purposeful retention. Agreed deletion.
When a service ends, the customer may choose return or deletion of data. Active service data, backups, security logs and archives are different datasets and may have different retention periods.
The planned hosting procedure provides restricted export access for up to 30 days after termination. Active copies are then deleted, and remaining backups expire no later than day 60 after the service ends. Earlier deletion and statutory retention exceptions are described in the data processing terms.
The schedule for email closure, export and final deletion is agreed separately under the Qboxmail contract. A 15-day message recovery window is not the deletion period for all email data.
Data locations, service partners and potential transfers outside the European Economic Area are documented before the agreement is accepted. A partner's certificate is not presented as Sibly's own certification.
Read the data processing terms and privacy policy for more information.
Suspect a security problem?
Email info@sibly.pro with the subject “Security issue”. Identify the affected domain or service, when you noticed the problem and a short description. Do not send passwords, authentication codes, API keys or an entire mailbox. If needed, we will arrange a secure way to share evidence.
The planned process includes risk assessment, containment, evidence preservation and customer notification. Breaches affecting customer personal data are reported without undue delay; the implementation plan sets an internal maximum of 24 hours after awareness for initial notice. We do not wait until the investigation is complete before sending that notice.
Coverage and response times are defined in the service agreement. Round-the-clock human coverage requires a separate service arrangement.
What can you do?
- Use unique passwords and multi-factor authentication where available.
- Keep devices and email software up to date.
- Remove access for departing employees and avoid sharing accounts.
- Verify requests to change payment details through another previously known channel.
Want to know more about your service's protection?
Contact info@sibly.pro. We can explain your package's safeguards, recovery options and retention arrangements.