Security and compliance

Where is your data, and how is it protected?

Data location, encryption, authentication, backups, KVKK and sub-processors: answers verified against the source code to everything procurement and IT teams ask.

Write to our security team →Privacy notice

Data location and deployment options

In the cloud service, data is hosted in Türkiye; if your data must never leave your organisation, the same software is installed on your own servers.

  • Hosted in Türkiye

    Cloud data is kept on servers hosted in a data centre in Istanbul, on encrypted disks.

  • On-premises installation

    The same software is installed on the organisation’s own servers, as at İSTAÇ and PTT KULE. The on-premises edition is not a separate or reduced version.

  • Per-company isolation

    Each organisation’s data is separated from the others, and the filter is applied automatically to every query in the application layer. Even when one person works for several organisations with one account, each organisation sees only its own data.

Encryption

TLS in transit; on the server, messages, secret platform settings and backups are encrypted.

  • TLS in transit

    Web, mobile and API traffic travels over TLS, and HTTPS requests carry an HSTS header. Notification e-mails are delivered over TLS-enabled SMTP.

  • Messages encrypted at rest

    Internal messages are encrypted with TLS in transit and AES-256-GCM on the server, and can be read only by the two parties to the conversation. It is not end-to-end encryption; the key is kept on the server, and on the organisation’s own server in on-premises deployments.

  • Secret settings encrypted

    Secret platform settings such as the SMTP password and the push service account are encrypted in the database with AES-256-GCM, under a key separate from the message key.

  • Passwords are hashed

    Passwords are never stored in plain text; they are hashed with PBKDF2-HMAC-SHA512 (100,000 iterations). Only the SHA-256 hash of API keys is kept.

Authentication and authorisation

Permission-based authorisation, scoped roles, short-lived session tokens and account control in the hands of the organisation’s administrator.

  • Permission-based authorisation and scopes

    Every endpoint is protected by a permission, and the role-to-permission mapping is managed by the organisation. Permissions are granted at own-record, team, department or whole-company scope, and changes take effect immediately.

  • Sessions

    Access tokens are valid for 15 minutes and are paired with a refresh token that is stored hashed and rotated on every use, with reuse detection. Users can see their open sessions and revoke any or all of them.

  • Password rules and lockout

    Passwords are at least 8 characters. After five failed logins the account is locked for escalating periods, and login and password reset endpoints are rate limited. Password reset uses a single-use code sent by e-mail.

  • Multiple organisations and home organisation

    One person can work for several organisations with a single account. Only the home organisation that employs them manages their profile and personal HR records; other organisations see them read-only.

  • Integration keys

    Integrations get their own account and API key; the key works only with the permissions of the role it is given and can be revoked at any time.

  • Audit trail

    Logins, lockouts and integration actions performed on behalf of someone else are written to the audit log, and the history of changes to a task is kept inside the task.

Backup and continuity

The database and files are backed up regularly in encrypted form, and backups are verified by restoring them.

  • Daily encrypted backups

    The database and file store are backed up daily; backups are encrypted and expired ones are deleted after the retention period.

  • Verified by restore

    Each backup is verified by restoring it into a temporary database before encryption; file backups are checked for integrity and file count.

  • Backup before every upgrade

    An automatic backup is taken before every schema change, and health checks continuously monitor the services.

KVKK and personal data

The organisation is the data controller and Sotech the processor. The account deletion process and cookie preferences are set out in the privacy notice.

  • Controller and processor

    For data about an organisation’s employees, the organisation is the data controller and Sotech is the processor acting on its instructions.

  • Account deletion and anonymisation

    Accounts are opened and closed by organisations. On a deletion request the administrator anonymises the account: personal details are cleared, the name becomes “Deleted user” and access in all organisations is closed; work records remain as the organisation’s legal records.

  • Cookies and analytics

    The web application uses only strictly necessary session cookies. On the marketing site, Google Analytics loads only with explicit consent, advertising signals are off and the choice can be changed at any time.

  • AI and data privacy

    The task creation assistant runs on an open-source licensed model: on Sotech’s own servers in the cloud and on the organisation’s server in on-premises installations. Task data is not sent to third-party AI services, prompts and model output are not logged, and the model only sees tasks the requesting user can already access. Suggestions are never saved automatically.

ISO 27001 and corporate assurance

Sotech Bilgi Teknolojileri, the company behind HibritİK, holds an ISO 27001 Information Security Management System certificate.

  • ISO 27001

    Information Security Management System certificate; processes are designed for working with audited organisations.

  • SPICE and public authorisations

    SPICE (ISO/IEC 15504) software process quality, plus Public IT and Software Authorisation Certificates.

  • Security review

    Before go-live, HTTP security headers, dependency vulnerabilities, authentication, authorisation and the file upload surface were reviewed against OWASP topics, and dependencies are kept current with security updates.

Summary for security questionnaires

Short answers to the questions that appear most often in procurement and information security forms. Write to us for questions specific to your organisation.

QuestionHibritİK
Where is data hosted?Cloud: Istanbul, Türkiye. Alternative: the organisation’s own servers (on-premises).
Encryption in transitTLS; HSTS on HTTPS.
Encryption at restEncrypted disks; messages and secret platform settings with AES-256-GCM; encrypted backups.
Tenant isolationPer company; the filter is applied automatically to every query in the application layer.
Authorisation modelPermission-based; role-to-permission mapping per organisation; scopes: own / team / department / company.
Password policyAt least 8 characters; PBKDF2-HMAC-SHA512 hashing; escalating lockout after 5 failed logins.
Session management15-minute access token; hashed refresh token rotated on every use; users can see and revoke sessions.
BackupsDaily encrypted database and file backups, verified by restore.
Audit loggingIdentity events in the audit log; task change history inside each task.
Sub-processorsHosting (Istanbul), Google Firebase and Apple notification services; consent-based Google Analytics on the marketing site.
AISelf-hosted open model (on the organisation’s server on-premises); no data is sent to third-party AI services and prompts are not logged.
CertificationSotech Bilgi Teknolojileri: ISO 27001.
Account deletionThe organisation’s administrator anonymises the account; personal details are cleared, work records stay with the organisation.

Sub-processors

Third-party services that touch personal data, only to the extent necessary. Details are in the privacy notice.

ServicePurposeLocationScope
Barındırma ve altyapı sağlayıcılarıCloud servers, e-mail deliveryTürkiye (Istanbul)Cloud service
Google Firebase (Cloud Messaging, Crashlytics)Delivering mobile notifications, fixing app errorsAbroadMobile apps
Apple Push Notification ServiceDelivering iOS notificationsAbroadiOS app
Google Analytics 4Marketing site usage measurement; only with explicit consentUSAhibritik.com
Cloudflare Web AnalyticsMarketing site page speed and traffic summary; cookie-freeAbroadhibritik.com

Privacy notice →|User agreement →

Frequently asked questions

Are messages end-to-end encrypted?

Messages are encrypted with TLS in transit and with AES-256-GCM on the server, and can be read only by the two parties to the conversation; no other user, administrators included, has access. It is not end-to-end encryption: the encryption key is kept on the server, which allows the message archive to be backed up and, in on-premises deployments, keeps the key entirely on the organisation’s own server.

Can you complete our security questionnaire?

Yes. The summary table on this page answers most questions; for your organisation’s own forms, write to [email protected].

Who is responsible for backups in an on-premises installation?

In an on-premises installation the servers, TLS and backups belong to the organisation’s IT team; HibritİK ships the scripts for encrypted, verifiable backups and the installation guide with it.

How do we delete a departing employee’s data?

The organisation’s administrator anonymises the account: name, contact details and photo are cleared and the account can no longer sign in. Task and activity records remain as the organisation’s legal records under the name “Deleted user”.

Related pages

Security & Data ProtectionData hosted in Türkiye, strict per-company isolation, scoped permissions and encrypted backups.Cloud & On-PremisesStart using HibritİK in the cloud right away, or install the same software on your own servers.

Start digitalizing your company today

Try it free for 14 days with every module enabled.

Start 14-Day Free Trial →Get in Touch