Built on a dedicated security team and comprehensive security framework, the Surplife Security & Trust Model includes multi-layered protection measures. It covers key domains: physical security, network security, software security, data security, identity authentication, compliance auditing, and business continuity. By integrating these elements, Surplife creates a robust security ecosystem to deliver trusted security protection for global users and enterprises.
Surplife is committed to delivering consistent, reliable, secure and compliant IoT access services for customers, and effectively safeguarding the availability, confidentiality and integrity of customer and end-user data. Centered on data protection and built upon cloud security capabilities, Surplife leverages its proprietary IoT solutions to build industry-leading competitiveness and establish a comprehensive cloud platform security system. We treat information security assurance as a key development strategy for Surplife.
To achieve these goals, Surplife implements multi-layer security protection, including security inspection, defense, monitoring and auditing for all services, forming end-to-end protection covering pre-incident, in-incident and post-incident stages. Meanwhile, by establishing a sound security system for hardware and software R&D, we embed information security and compliance controls into the full lifecycle of software and hardware development, so as to guarantee the security quality of delivered products.
Surplife cloud services are deployed on Alibaba Cloud. Drawing on Alibaba Cloud’s mature cloud infrastructure and security capabilities, we build a defense-in-depth system covering networks, hosts, containers, applications and data links. The platform leverages Web Application Firewall (WAF) and network access control to fend off Web attacks, malicious traffic and unauthorized access. Combined with host and container security protection, vulnerability management, access control and security configuration checks, we continuously mitigate infrastructure and operational risks. The platform centrally logs, monitors, alerts and analyzes access and security events for core services. It forms a closed-loop security mechanism of pre-warning, real-time detection & response, and post-incident traceability, and continuously optimizes protection strategies based on business risks to ensure stable cloud service operation and user data security.
Surplife develops cloud, APP and smart device products in strict accordance with the Secure Software Development Lifecycle (SSDLC), aiming to integrate information security throughout the software lifecycle. Surplife’s SSDLC covers every phase of system development, including but not limited to review, development, testing, release and launch, with full-process security governance.
Surplife has built a holistic and systematic data security system. From the perspective of the full data lifecycle, the system adopts both management and technical measures to ensure rigorous governance and control over data during collection, storage, processing, transmission, sharing and deletion. This system delivers robust data security guarantees for customers and preserves the integrity, confidentiality and availability of user data.
Surplife’s smart hardware solutions adopt full-chain security authentication and encryption to realize reliable device authentication, secure communication, firmware protection, system security and OTA security. These solutions have passed various global information security audits and certifications, including but not limited to NIST 9259, PSA and other authoritative security certifications for smart products, as well as EN18031, CE, EN303645 and other certifications.
