Legal

Security Policy

The measures we take to protect customer data.

Son güncelleme: 2026-05-25

Note on this English translation

This English version is provided for information purposes only. It is a courtesy translation of the Turkish original. In the event of any discrepancy or conflict of interpretation, the Turkish version of this document shall prevail.

1. Our Security Approach

At Sysnet, we treat the confidentiality, integrity and availability of customer data as our highest-priority business rule. Our security policy is aligned with the principles of ISO/IEC 27001, the KVKK Data Security Guide, the NIST Cybersecurity Framework and the OWASP standards.

In the sections below you will find the technical and administrative measures we apply, together with our responsible vulnerability disclosure procedure.

2. Encryption

  • All web traffic is encrypted with HTTPS / TLS 1.2 and TLS 1.3; HSTS preload is enabled.
  • Modern cipher suites (ECDHE-ECDSA / ECDHE-RSA, AES-GCM and ChaCha20-Poly1305) are used.
  • Passwords are hashed with bcrypt (cost 12) and cannot be reversed.
  • TOTP two-factor authentication secret keys are stored in encrypted form; backup codes are hashed with bcrypt.
  • Database backups are encrypted with AES-256.
  • Log records within the scope of Law No. 5651 are secured for integrity by means of an electronic signature and a time stamp.

3. Access Control

  • The principle of least privilege is applied.
  • Role-based access control (RBAC): admin, editor and viewer roles plus 24 fine-grained permissions.
  • Two-factor authentication (TOTP) is mandatory for administrator accounts.
  • Protection against brute-force attacks: a 1-hour IP ban (fail2ban) after 5 failed attempts within 10 minutes.
  • All privileged access is recorded in the audit log; the logs are tamper-evident.
  • Session management: HttpOnly + Secure + SameSite=Strict cookies, with automatic session timeout.
  • On a password change or account deactivation, all active sessions are automatically terminated.

4. Network and Infrastructure Security

  • Apache reverse proxy plus application-layer isolation; only local (127.0.0.1) connections to the database.
  • A minimum open-port policy enforced by an operating-system-level firewall (firewalld/nftables).
  • Content-Security-Policy (CSP), X-Frame-Options DENY, Referrer-Policy, Permissions-Policy, COEP/CORP and COOP headers.
  • A Cloudflare CDN layer for DDoS protection.
  • Regular operating-system and library security patches.
  • SystemD service hardening: NoNewPrivileges, ProtectSystem, ProtectHome, PrivateTmp.

5. Data Security and Backup

  • The database and media files are backed up automatically every day; 14-day retention.
  • Backups are stored on separate physical media.
  • Restore tests of the backups are carried out periodically.
  • Disaster recovery (DR) plan: RPO ≤ 24 hours, RTO ≤ 4 hours.
  • Sensitive data (password hashes, 2FA secrets) is protected with additional encryption and restricted access.

6. Application Security

  • Development in accordance with the OWASP Top 10 and OWASP ASVS guidelines.
  • Use of parameterized queries in all SQL queries (protection against SQL injection).
  • Bluemonday-based HTML sanitization (protection against stored XSS).
  • Mandatory CSRF tokens on all write endpoints.
  • Magic-byte-based file-type validation and protection against file-path traversal.
  • File upload limits, MIME whitelisting, and prevention of script execution on uploaded files.
  • Rate limiting on login, download-request and public form endpoints.

7. Monitoring and Incident Response

  • Server, application and database logs are collected centrally.
  • Automatic alerting when suspicious activity is detected.
  • Incident Response Plan: detection – containment – root-cause analysis – remediation – reporting.
  • When a personal data breach is detected, the Personal Data Protection Authority (Kurul) and the affected data subjects are notified within 72 hours at the latest, in accordance with Article 12/5 of the KVKK.

8. Responsible Vulnerability Disclosure

If you have discovered a security vulnerability, we kindly ask you to report it responsibly. We undertake not to initiate legal action provided that you comply with the following rules:

For significant findings, we may credit the discoverer's name (with their permission) on our security acknowledgements page and may grant a symbolic reward.

  • Not exploiting the vulnerability maliciously and not disclosing it to third parties;
  • Not accessing, modifying or deleting user data;
  • Not intentionally disrupting the service (DoS, brute force);
  • Reporting the finding solely to security@sysnet.com.tr and allowing us 90 days to remediate;
  • Clearly sharing detailed reproduction steps and a proof of concept (POC).

9. Employee Security and Awareness

  • KVKK and information-security training for all employees from the moment of hiring.
  • Employees are bound by a non-disclosure agreement (NDA).
  • In the event of a change of duties or departure, access rights are revoked within 24 hours.
  • The four-eyes principle for sensitive operations.

10. Compliance

  • Law No. 6698 (KVKK) and its secondary legislation
  • Law No. 5651 on the Regulation of Publications Made on the Internet
  • The European Union GDPR (for affected data subjects)
  • ISO/IEC 27001 (controls applied)
  • OWASP ASVS
  • NIST Cybersecurity Framework

11. Contact

  • Security reports: security@sysnet.com.tr
  • KVKK / data protection: kvkk@sysnet.com.tr
  • Legal: legal@sysnet.com.tr
  • RFC 9116 security.txt: https://signlogger.com/.well-known/security.txt