Security objectives
We work to protect confidentiality, integrity and availability through layered administrative, technical and physical controls proportionate to risk. Security measures are reviewed and improved as technology and threats change; we do not claim that a system is breach-proof.
Identity and privileged access
Administrative permissions are restricted according to job need and least privilege. Authentication methods, revocation, access reviews and privileged-session procedures are controlled internally. Customer secrets must not be requested in ordinary support messages.
Network, systems and monitoring
We use appropriate network restrictions, security updates, logging, change controls and integrity monitoring according to the service architecture. Monitoring is intended to protect infrastructure and investigate incidents, not to sell or commercially profile customer content.
Separation of responsibilities
For unmanaged hosting and VPS services, customers ordinarily secure their applications, websites, user accounts and guest operating systems. 3000Host secures the provider-managed infrastructure within its responsibility. Any managed-service exception must be explicitly described in the approved plan.
Incident handling
Security events are triaged, contained, investigated and documented according to severity. Where required by law, competent authorities and affected data subjects are notified through appropriate channels. Evidence is preserved lawfully and access to incident details is limited.
Service providers and data location
Third-party providers are assessed in relation to their security role, confidentiality obligations and data handling. Cross-border arrangements are evaluated under applicable Omani privacy requirements and contractual safeguards. A specific data-residency promise exists only when written into the selected service agreement.
Customer reporting
Customers should promptly report a suspected compromise, protect evidence without spreading secrets and take available immediate containment steps. Reports can be directed to the verified company contact.