Certifications
This page states our position exactly as it is. Our controls are designed against the standards below and formal certification work is in progress. Where a certificate has not been issued yet, we say so instead of implying otherwise — and we do not name an auditor or an audit date until one exists.
Standards our controls are designed against
| Standard | Scope | Where we stand |
|---|---|---|
| ISO 27001:2022 | Information security management system | Controls designed against the standard — certification in progress |
| PCI DSS v4.0, Level 1 Service Provider | Cardholder data environment | Certification process under way — see PCI DSS |
| SOC 2 (Security, Availability, Confidentiality) | Service organisation controls | Control set mapped to the criteria — no report issued yet |
| ISO 27701 | Privacy information management | Privacy controls aligned — certification in progress |
Regulatory alignment
Alignment means our architecture and controls are built against the framework's requirements. It is not a statement that a regulator or an auditor has assessed us.
| Framework | Region | Where we stand |
|---|---|---|
| GDPR | EU | Processing model documented, DPA available — see GDPR |
| KVKK | Türkiye | Technical and organisational measures implemented — see KVKK |
| DORA | EU | ICT risk and operational resilience requirements used as design input |
| MAS TRM | Singapore | Technology risk requirements used as design input |
| FCA SYSC | UK | Governance and control requirements used as design input |
| FATF Recommendations | Global | R.10 / R.15 / R.16 mapped — see FATF |
| MASAK | Türkiye | Sanctions list ingestion and procedural gates implemented — see MASAK |
Documents we can share
| Document | Availability |
|---|---|
| Data Processing Agreement (DPA) | On request — [email protected] |
| Security overview and control matrix | Under NDA — [email protected] |
| Encryption and key management description | Under NDA — [email protected] |
| ISO 27001 certificate · SOC 2 report · PCI DSS AoC | Not yet issued — we will share these once certification completes |
Security testing
An independent penetration test has been carried out. A summary that can be shared under NDA is in preparation; we will announce it on this page once it is ready. We do not publish the provider's name, its accreditation or the test date.
Reporting a vulnerability
If you find a security issue, please disclose it responsibly to [email protected]. We acknowledge every report and keep you updated through remediation.