Security of Services

Whether you are registering a strategic domain name, deploying an SSL certificate, hosting your website and corporate email on cPanel hosting, or managing VPS servers and DNS zones – infrastructure stability and resilience are the foundation of your business.

For us, security is neither a formality for an audit nor a one-time project. It is daily systems engineering, rigorous operational procedures, and a conscious choice of technologies. Below we present the technical and organizational standards that protect your data and guarantee the continuity of your services.

1. Essential Entity Status (KSC / NIS2) & Supply Chain Security

Our organization holds the status of an Essential Entity (Podmiot Kluczowy) under the Polish Act on the National Cybersecurity System (KSC), implementing the EU NIS2 Directive, in the following categories:

• DNS Service Provider (Sector: Digital Infrastructure)
• Domain Name Registration Service Provider (Sector: Digital Infrastructure)
• Electronic Communications Undertaking (Sector: Electronic Communications)

• No High-Risk Vendors (HRV): We exclusively use vetted hardware, network connection, and software providers, eliminating vendors designated as high-risk.
• Formalized Incident Management: We have precise procedures for event detection, immediate response, and reporting to the competent CSIRT.
• Organizational Maturity: We continuously assess operational and technical risks, ensuring constant improvement of applied protective measures.

2. Architecture, Redundancy, and Business Continuity Planning (BCP)

In designing our production environment, we eliminated single points of failure (Single Point of Failure) through physical and geographical diversification of facilities:

Precise Backup Strategy (3-2-1 Model)

• Client hosting data and mail: Automatic backups are performed on a daily cycle to separate storage arrays located within the respective data center (both in Wrocław and in Toruń).
• Critical system data and databases: Replicated in daily cycles, with key databases replicated as frequently as every hour in strongly encrypted form to an external repository in an independent datacenter in Germany.

Continuous 24/7/365 Monitoring

We monitor service availability, network traffic, and hardware health around the clock, with instant engineer alerting.

3. Modern Cryptography and Transmission Security

We apply uncompromising cryptographic standards to protect network traffic from eavesdropping, tampering, and spoofing attacks:

• DNS Zones with DNSSEC Support: All our domain zones are secured and cryptographically signed by default with the DNSSEC protocol. This protects users against DNS cache poisoning (DNS cache poisoning) and forged nameserver responses.
• TLS 1.3 Standard & Retirement of Outdated Versions: On hosting servers, mail servers, and management panels, we enforce support for modern TLS 1.3 and TLS 1.2 protocols. We have phased out support for vulnerable protocols (SSLv3, TLS 1.0, TLS 1.1) and weak ciphers (weak ciphers).
• Forward Secrecy: We exclusively use secure cipher suites ensuring confidentiality of transmissions even in the event of potential future key compromise.
• Automated SSL/TLS Certification: We provide automatic issuance and renewal of free SSL certificates (AutoSSL) for domains and subdomains, as well as full support for commercial certificates (DV, OV, EV).

4. Security of Hosting Platform and VPS Servers

The shared hosting platform and managed VPS servers are protected at the operating system kernel level, network layer, and application processes:

• Reputable cPanel Ecosystem & Fast 24/7 Patching: We use cPanel software – a leading global control panel provider. cPanel maintains a 24/7 response team and immediately delivers automated software updates and related system packages.
• Account Separation with CloudLinux & CageFS: Each hosting account is fully isolated within a virtual container (CageFS). Users cannot view files, databases, or processes of other clients, completely eliminating cross-infection risks on the server.
• Active Imunify360 Protection (WAF & Anti-Malware): All web traffic is filtered in real time by a Web Application Firewall (WAF) powered by machine learning algorithms. The system actively blocks vulnerability scanners, code injection attempts (SQLi, XSS), and brute-force attacks.
• Kernel Live Patching with KernelCare: Critical Linux kernel security patches are applied on the fly, without restarting physical machines and without service downtime for your email or websites.

5. Personnel Security and Access Control

We follow the principle of least privilege and strict administrator identity protection mechanisms:

• Hardware MFA Based on YubiKey (FIDO2) Keys: All our personnel and administrators with access to infrastructure and internal systems authenticate exclusively using physical U2F/FIDO2 hardware keys. This eliminates the risk of account takeover via phishing or credential leaks.
• Principle of Least Privilege & VPN-Only Access: Production server administration is carried out exclusively through dedicated, encrypted VPN tunnels with strict role separation (Principle of Least Privilege). Management ports are never exposed publicly to the Internet.
• Personnel Background Checks (Art. 8f KSC): Employees and contractors performing cybersecurity tasks undergo verified background checks for lack of criminal record from the National Criminal Register as well as regular training in cyber hygiene and operational procedures.

6. Protection in the Main Client Panel (Domeny.tv)

The main client panel is the central hub for managing your identity, domain rights, DNS configurations, SSL certificates, and associated services:

• Multi-Factor Authentication (2FA): Support for TOTP time-based code generator apps and physical FIDO2 / YubiKey hardware keys (learn more about 2FA).
• Cryptographic Password Hashing: User passwords are irreversibly hashed in databases using strong cryptographic hash functions and unique salts – no employee knows your password, and we will never ask for it.
• Protection of Critical Operations: Changing the primary email address requires authorization from the old address or manual identity verification. Authorization codes (Authinfo) and domain assignments/transfers are subject to strict authorization procedures (learn more).
• Activity Log and IP Alerts: Full visibility into login history (successful and failed) with IP address and browser recording, plus notifications of activity from new locations.

7. Hosting Control Panel Security (cPanel)

The cPanel interface provides an autonomous technical layer for managing website files, MySQL databases, and email mailboxes:

• Independent Credentials: Logging into cPanel uses a separate login and password over an encrypted HTTPS connection on a dedicated, secure port.
• Native 2FA in cPanel: Direct support for two-step authentication for hosting login using authenticator apps (TOTP).
• Email Security Management: Convenient configuration of key sender authentication records: SPF, DKIM, and DMARC policies directly from the panel.
• Encrypted File Transfer (FTPS / SFTP) and Permission Controls: Full support for encrypted FTPS (FTP over TLS) with the ability to create accounts restricted to specific directories (e.g., for external contractors), as well as SFTP support based on SSH cryptographic keys for the primary account administrator.

8. Vulnerability Reporting (Coordinated Vulnerability Disclosure)

We cooperate with the security research community and our clients based on transparent industry standards:

• security.txt Standard: We have implemented the RFC 9116 standard on our servers, available at the path /.well-known/security.txt.
• Dedicated Reporting Channel: Please direct any reports regarding cyber threats, vulnerabilities, incidents, or technical feedback to: security (at) mserwis.pl.

9. Best Practices: How to Effectively Secure Your Services

Security is a shared responsibility. The highest standards of server infrastructure yield full results only when you maintain proper cyber hygiene on your end.

10. How We Inform About Incidents and Threats

In accordance with Art. 11 (2a) and (2b) of the Polish Act on the National Cybersecurity System (KSC), we ensure transparent and prompt communication with our service users regarding significant cyber threats and major incidents impacting the provision of our services.

Upon identification of a threat or incident, we provide information on the nature of the event and – where applicable – on any mitigation and corrective measures that clients can apply on their side. Communication is conducted via the following channels:

• Email messages: Direct notifications sent to the contact email address associated with the client's account in our control panel.
• Status / Announcements page: Official announcements and updates are published on an ongoing basis on our information pages:
  • https://www.domeny.tv/komunikaty
  • https://www.mserwis.pl/komunikaty

We do not operate a commercial Bug Bounty program and do not offer monetary rewards or financial compensation.

We value the contributions of the security research community and support Coordinated Vulnerability Disclosure (CVD). To individuals who report a confirmed vulnerability with a real impact on security in good faith, we offer:

• with their consent, an entry in our public Hall of Fame,
• a written acknowledgement of the report, issued once the vulnerability has been remediated.

We do not enter into correspondence regarding compensation for reports. We review every vulnerability report regardless of its form and any accompanying demands.

Why Choose Domeny.tv

Find out why Domeny.tv is the right choice as a trusted partner for maintaining your domain names and other online services.

Meet Our Clients

See who we already work with.

Have questions? Feel free to contact us.