1. Introduction and Purpose
Midnight Technologies LLC ("the Company") provides telecommunications and/or interconnected VoIP services. The
Company is committed to protecting the confidentiality of its customers' Customer Proprietary Network Information (CPNI) in
accordance with Section 222 of the Communications Act and the Federal Communications Commission (FCC) rules set forth
in 47 C.F.R. Section 64.2001 et seq. This statement describes the Company’s operating procedures designed to ensure
compliance with these rules.
2. Customer Authentication Procedures
The Company protects CPNI from unauthorized disclosure by authenticating customers before disclosing account information:
In-Person and Inbound Support: Employees must verify the customer’s identity by checking a valid government-issued
photo ID (for in-person interactions) or by requiring a pre-established, secure password/PIN before discussing or
disclosing any CPNI.
Online Account Access: Customers accessing their accounts online must authenticate using a secure password and
username. The Company utilizes multi-factor authentication (MFA) where available.
Call Detail Records: The Company does not disclose call detail records over the phone unless the customer provides
the account password or PIN.
3. Notification of Account Changes
The Company immediately notifies customers when a password, customer response to a back-up means of authentication,
online account username, or physical/email address of record is created or changed. Notifications are sent via the customer’s
chosen method of contact (e.g., email or SMS) or by mail to the address of record.
4. Employee Training Program
The Company trains all employees who have access to CPNI or interact with customers regarding the appropriate use and
disclosure of CPNI.
New employees receive CPNI training during onboarding or training.
Existing employees receive annual refresher training.
Training covers the legal definitions of CPNI, authentication protocols, disciplinary consequences for unauthorized
disclosures, and the requirement to report data breaches.
5. Regulatory and Marketing Use of CPNI
The Company does not use, disclose, or permit access to CPNI for marketing purposes without obtaining the express prior
consent (Opt-In or Opt-Out, as applicable under FCC rules) of the customer, except as permitted by law for the provision of the
service from which the information is derived.
6. Disciplinary Actions and Enforcement
The Company maintains a zero-tolerance policy for intentional violations of its CPNI policies. Any employee who discloses or
accesses CPNI without authorization is subject to disciplinary action, up to and including immediate termination of
employment.
7. Corporate Certification
As required by 47 C.F.R. § 64.2009(e), a corporate officer has executed the accompanying certification verifying the
Company’s compliance with the FCC’s CPNI rules for the preceding calendar year