Information Security Policy

Eticaretiz treats the security of customer and transaction data as a top priority. We apply industry-standard security controls to protect our platforms, databases and APIs.

1. Infrastructure and Network Security

• Hosting: Our servers and databases are hosted in professional data center environments.
• Network isolation: Firewall and private subnet configurations prevent direct internet access to database servers.
• Endpoint protection: Our server environments are protected by endpoint security and access monitoring controls.

2. Encryption in Transit

All connections to our website, dashboard and API servers are encrypted over HTTPS using TLS 1.2 or TLS 1.3.

3. Encryption at Rest

Database backups and configurations are protected by encryption controls in line with our data classification policies.

4. Identity and Key Management

• Least privilege: Access to infrastructure management panels and credentials is restricted to authorized system engineers.
• Secure configuration: Default passwords and test keys are blocked in production; secrets are not kept in application code but loaded onto servers through environment variables.

5. Logging and Monitoring

Critical read and write operations on the database and APIs are logged with identity and timestamp details.

6. Vulnerability Management

We regularly review our application dependencies for security updates.

7. Incident Response

In the event of a security incident, our team initiates our Incident Response Plan to isolate the threat and notify the parties concerned.

• Amazon notification: Incidents affecting Amazon data or Amazon credentials are reported to Amazon at security@amazon.com.

8. Reporting a Security Issue

If you notice a vulnerability or suspicious activity, please report it to bilgi@eticaretiz.com.