PART IV: PRESERVATION, SOURCE CUSTODY AND A NEW WHITELIST PROCESS
The September 15 preservation-status exchange, renewed preservation request, source-custody questions, proposed formal whitelist review and Hostinger’s later statement that no additional source disclosure was required while those questions remained unresolved.
September 15 became a separate accountability chapter because the correspondence moved beyond the September 10 removal itself and into verified preservation status, prior and proposed source-code custody, and a newly described whitelist review process.
12:20 — Hostinger restated the platform-wide policy
Customer Success said the automated scanning policy for standalone PHP file managers was consistent and platform-wide, that new detections of the same file type fell under the same policy, and that its position remained unchanged. That response did not answer the specific question of whether a preservation hold had actually been applied to the September 10 records or object.
13:08 — The preservation question was reduced to Yes or No
The follow-up asked Hostinger to confirm only whether the requested preservation or retention hold had actually been applied. If yes, it requested the application time, an internal reference and confirmation of continued retention. If no, it requested the current existence and any expiry or deletion status of a retained original or quarantine object.
13:33 — Hold still unverified; a new whitelist process was proposed
Hostinger said it could not yet confirm whether a preservation hold had been applied to the September 10 detection-event records or to the original/quarantined manager.php object and promised a verified Yes-or-No answer after internal verification.
The same message stated Hostinger’s current policy that customer-initiated preservation requests do not automatically trigger a hold and requested the full manager.php source through pwpush.com for a “formal whitelist review” described as separate from the Imunify platform-wide policy. This publication reports that as Hostinger’s stated policy and process description, not as an independent legal conclusion.
14:39 — Preservation was renewed and another source-disclosure chain was declined pending custody answers
The customer expressly renewed and continued the preservation request and said another complete copy of proprietary source would not be transmitted until the custody, purpose, recipients, access controls, retention and disposition of the proposed disclosure were defined in writing.
The message expressly said this was not a refusal of a properly scoped independent technical review and requested reconciliation of the new whitelist description with the earlier position that no whitelist exception path was available for the category.
14:48 — No additional source disclosure required while custody questions remained unresolved
Hostinger acknowledged the renewed preservation request and said it still could not provide a verified Yes-or-No answer on whether a preservation or retention hold had been applied. It also said it could not responsibly confirm the existence, expiry, deletion status or retention period of the relevant records without completing internal verification.
Hostinger then stated that no additional source-code disclosure was required while the custody, purpose, recipients, access controls, retention and disposition questions remained unresolved. It also said the next written response would need to reconcile the category-based classification, proposed whitelist review, its authority and possible outcome, and exact file-version identity.
Hostinger committed that it would not characterize a later or current file as the September 10 incident-time object.
What remained unresolved at the editorial cutoff
As of September 15, 2026 at 14:48 CEST, the verified preservation answer was still pending. Hostinger had not yet confirmed whether the hold was actually applied or the existence, expiry, deletion status or retention period of the relevant records or original/quarantine object. The promised reconciliation of the whitelist process, its authority and possible outcome, and the remaining source-custody questions also remained pending.