This English text is an informational translation. The agreement is concluded in Turkish and governed by Turkish law; in case of any discrepancy, the Turkish version prevails.
Measures we apply
- All traffic is carried over TLS.
- Passwords are hashed with Argon2id; no plaintext password is stored anywhere.
- Push signing keys and mobile provider credentials are stored encrypted with AES-256-GCM.
- Session refresh tokens are stored hashed; a reused token invalidates the whole session family.
- Tenant isolation is applied on every query and continuously verified by automated tests.
- API keys are stored hashed, shown once at creation, and can be revoked instantly.
- Sign-in is rate limited with progressive account lockout; error messages do not reveal whether an account exists.
- Every outbound request to a customer-supplied address passes SSRF protection; access to internal network and cloud metadata addresses is blocked.
- Outgoing webhooks are signed with a timestamped HMAC-SHA256 signature and protected against replay.
- Database backups are encrypted.
What we offer: TOTP two-factor authentication with recovery codes, a panel-visible audit log of security actions on your account, scoped API keys with zero-downtime rotation, a block on sending from an unverified domain, and second-person approval for sends to large audiences. What we do not offer yet: an independent penetration test report and an independent status page hosted outside our own infrastructure. Those are on the roadmap and will not be described as if they existed before they do.
Responsible disclosure
If you find a security vulnerability, report it to [email protected]. We acknowledge your report within 3 business days and share the outcome of our assessment within 10 business days.
We will not take legal action against researchers acting in good faith. In return: test only with data on your own account, do not access other customers’ data, do not run load tests that disrupt the service, and do not share a vulnerability with third parties before it is fixed.
We do not run a paid bug bounty programme at present; with their permission we credit contributing researchers on a thanks list.
Data breach procedure
- Detection: an incident record is opened from monitoring, a customer report or a researcher report.
- Containment: the affected component is isolated and, if needed, the relevant keys are revoked and rotated.
- Impact analysis: which data categories, how many people and which customers are affected is established.
- Notification: affected customers are notified without undue delay and in any event within 72 hours.
- Regulator notification: where legislation requires it, the Turkish Data Protection Authority is notified.
- Recovery: the system is returned to a safe state, restoring from backup if necessary.
- Root-cause analysis and corrective actions are determined.
- A post-incident report is prepared and shared with affected customers.
The notice to customers covers the nature of the breach, the data categories affected, the likely consequences, and the measures taken and recommended.