Security & Privacy
Client work follows the same security rules as our own products. Below is how each part is handled.
06 principles
- 01
Your data and systems stay with you
The system runs in your accounts and on your servers. Databases, infrastructure and documentation are yours. On custom software work the source code is handed over to you as well. When a project ends we remove our access, unless you have asked us for ongoing support. A maintenance agreement is optional, and another team can take over.
- 02
KVKK and GDPR
We process personal data in line with Turkey's data protection law (KVKK) and the EU's GDPR. It is stored encrypted and not shared with anyone without explicit consent. Where your data goes, where it is processed and what is kept is written in the scope document. In our own apps, user data stays on the device by default.
- 03
An NDA before the first call
If you ask, we sign a non-disclosure agreement before the discovery call. Your business rules, your data and your customer information stay between us and are not shared with any other client. Everyone who works on the project is bound by the same agreement.
- 04
Encryption and access
Data is encrypted in transit with TLS. Code sits in private repositories. Passwords and keys are kept in environment variables, never in the code. Who can see what, and who can change what, is set separately at every layer. We build on the assumption that someone will try to get in one day.
- 05
Security during development
Dependencies are scanned automatically for known vulnerabilities, and input from outside is validated. Code review checks security as a separate item. We plan the architecture with security in mind from the start.
- 06
Visibility
You can see how the system is built, why each decision was made and what was traded off. Where we use AI, we say so, and we won't build a setup you don't want. If we see a risk, we tell you without waiting to be asked.
Questions about our security practices?
hello@unholylabs.com