Trust
This page gathers what your procurement and vendor-assessment process needs in one place: where we stand, which documents we can share, and how to report a security issue to us.
Every line on this page describes today's position. Where a document has not been issued yet, we say "in preparation" rather than implying otherwise.
Compliance position
| Area | Where we stand |
|---|---|
| PCI DSS | Our controls are designed against v4.0 Level 1 Service Provider requirements; certification is in progress — see PCI DSS |
| KVKK (Türkiye) | Technical and organisational measures implemented — see KVKK |
| GDPR | Processing model documented — see GDPR |
| MASAK (Türkiye) | Sanctions list ingestion and procedural gates implemented — see MASAK |
| FATF | R.10 / R.15 / R.16 mapped — see FATF |
| ISO 27001 · SOC 2 | Certificate or report not yet issued — see Certifications |
Security controls
A summary of encryption, access management, audit logging, log hygiene, retention and erasure controls is on a separate page: Security Controls.
On the decision side — the fraud engine — who authors a rule, how it is published and how it is rolled back is described in Decision Governance.
Retention, erasure and legal hold
For each product we document the retention window, what happens to a record at the end of it, how an erasure request is carried out and how a legal hold stops both:
| Product | Page |
|---|---|
| Identity verification and identity/device signals | KVKK |
| Fraud prevention | Data Retention and Legal Hold |
| Wallet | Data Retention and Legal Hold |
Those pages describe capabilities. Which windows apply to your own installation, and whether automatic destruction is switched on, is put in writing in the retention annex of the DPA.
Use of AI
Where AI runs on the platform, the principles it is bound by, how human oversight is enforced and how decisions are explained are collected in a written policy: Responsible AI Policy.
Three further records are published alongside it:
| Document | Content |
|---|---|
| EU AI Act | The risk class of each component and its reasoning; there is no prohibited practice and no high-risk system |
| Model Review Policy | How reviews are conducted: roles, cadence, method, finding classes, escalation |
| AI Literacy | The staff competence programme, its content and the attendance record |
| Model Review Log | The record of scheduled reviews |
Documents we can share
| Document | Access |
|---|---|
| Data Processing Agreement (DPA) and annexes | On request — [email protected] |
| Security overview and control matrix | Under NDA |
| Encryption and key management description | Under NDA |
| Independent penetration test summary | In preparation — we will announce it on this page once ready |
| Sub-processor list | Under NDA |
| Hosting and data residency statement | As a DPA annex, specific to your deployment |
| ISO 27001 certificate · SOC 2 report · PCI DSS AoC | Not yet issued; we will share them once complete |
Data residency
Data for Türkiye is hosted on infrastructure we operate ourselves; object storage and key management are not delegated to a third-party cloud provider. A region-specific deployment can be provisioned, with its own storage target and its own key management.
A written and binding statement of where your data actually resides is provided as the hosting annex to the DPA. We do not publish a general region table, because it varies from deployment to deployment.
Incident notification
We notify affected organisations within 72 hours at the latest of becoming aware of a personal data breach. The notification covers the nature of the breach, the data categories affected, its likely consequences and the measures taken. Notification to the supervisory authority and to data subjects is the controller's obligation; we supply the information and evidence required.
Vulnerability reporting
If you find a security vulnerability, please report it responsibly to [email protected]. We acknowledge every report and keep you informed during remediation. We ask that you give us time to remediate before public disclosure.
Questions
For scope assessments, document requests or vendor-assessment forms: [email protected]