Information Security Policy

The purpose of this policy is to protect the confidentiality, integrity and availability of the information assets used in the software development, installation, hosting, support and training activities carried out by Doğansoft (“the Company”), to manage information security risks and to ensure compliance with legal, regulatory and contractual obligations.

This policy covers the Company’s employees and interns, suppliers and solution partners acting on behalf of the Company, all information systems managed by the Company, software source code, server and network infrastructure, customer data and all information assets, whether in printed or electronic form.

• Confidentiality: information is accessed only by authorised persons, to the extent required by their duties.
• Integrity: the accuracy and completeness of information are preserved and safeguarded against unauthorised modification.
• Availability: information and services are available to authorised users when needed.

• to identify and assess information security risks regularly and reduce them to an acceptable level,
• to comply with the relevant legislation, in particular Law No. 6698 on the Protection of Personal Data, and with obligations arising from contracts with customers,
• to take into account the obligations of the public institutions we serve, having regard also to the requirements of the Digital Transformation Office of the Presidency – Information and Communication Security Guide,
• to process customer data solely for the purposes specified in the contract and on the customer’s instructions,
• to treat security as an integral part of the development process, starting from the design stage of the software,
• to continually raise employees’ information security awareness through training,
• to detect and respond to security incidents promptly and to take measures to prevent their recurrence,
• to review this policy and its implementation regularly with a view to continual improvement.

• Access rights are granted according to job description on the “need-to-know” and “least privilege” principles, and are updated or revoked without delay upon a change of role or departure.
• Access to administration panels and servers is through individual accounts; shared accounts are not used.
• Strong password rules are applied; passwords are stored in an irreversible form, and accounts are temporarily locked after repeated failed login attempts.
• Access to critical systems is logged.

• Source code is kept in version control systems with restricted access.
• Changes are tested before release; user input is validated on the server side.
• Third-party libraries are obtained from trusted sources and their security updates are monitored.
• Secret keys, passwords and access credentials are not written into source code; they are kept in separate environments with restricted access.
• In test and development environments, sample or anonymised data are used instead of real personal data wherever possible.

• All external connections are made over encrypted protocols (TLS).
• Only necessary services and ports are kept open on servers; services are run in environments isolated from one another.
• Rate limiting and browser security headers are applied to guard against misuse.
• Operating system and software updates are applied regularly.

• Databases and uploaded files are backed up regularly; backups are kept in environments with restricted access and are deleted automatically at the end of the specified period.
• The restorability of backups is tested.
• Recovery steps in the event of service interruptions are determined in advance.

Contracts containing confidentiality and data protection obligations are concluded with suppliers and solution partners who have access to information assets. Such persons are granted the minimum access required for the work, and their access is revoked upon completion of the work.

• Suspicious events are recorded immediately, their impact is assessed and a response is made.
• In the event of a personal data breach, in accordance with Article 12 of the KVKK and the decisions of the Personal Data Protection Board, the Board is notified without delay and within 72 hours at the latest of the breach becoming known, and the affected persons are notified within the shortest reasonable time.
• Where the Company acts as data processor, the breach is notified without delay to the institution acting as data controller, and the information necessary for the institution to fulfil its notification obligation is provided.

If you discover a security vulnerability in the Site or in our products, please write to the application e-mail address given in the Privacy Notice with the subject line “Security report”. We ask that you make your report in good faith and confine yourself to what is necessary to demonstrate the vulnerability:

• do not access, modify or delete data belonging to others; if you gain access inadvertently, stop immediately and notify us,
• refrain from tests that would disrupt the service (load testing, denial of service, intensive scanning with automated tools),
• do not share the vulnerability with third parties before it has been remedied.

Reports made in good faith in compliance with these rules will be assessed, and you will be informed of the outcome. This section does not constitute permission to access or test our systems without authorisation; the provisions of Turkish Criminal Code No. 5237 relating to cybercrime are reserved.

The Company’s management is responsible for the implementation of this policy. All employees and persons acting on behalf of the Company are obliged to comply with the policy. Conduct in breach of the policy will be dealt with under the employment contract, the relevant contracts and the applicable legislation.

This policy is reviewed at least once a year and whenever a significant change occurs. The current version is always published on this page.