Security & Compliance

Encryption at Rest

• Encryption in transit: all traffic over TLS (see below). Storage-layer encryption relies on the hosting provider's disk encryption; we do not claim application-level AES-256 at rest.
• Database access: Runtime role runs with least privilege — no DDL/DROP or RLS-disable rights (verified). Note: upstream PostgreSQL does not provide TDE; disk-level encryption is a hosting-layer control.
• File storage: Stored on the application server's own disk. AWS S3 is not used — the SDK is not even a dependency.
• Backups: Daily automated database backup (scheduled) plus a pre-deployment image snapshot.

Encryption in Transit

• TLS 1.3 for all web traffic (minimum TLS 1.2 supported)
• HTTPS enforced: HTTP Strict Transport Security (HSTS) with 1-year max-age
• API security: All endpoints over HTTPS; endpoints requiring authentication return 401 without a valid token (verified in production).
• Perfect Forward Secrecy (PFS): Ephemeral key exchange (ECDHE) for session keys

Password Security

• bcrypt hashing: All passwords hashed with bcrypt (cost factor: 12 rounds)
• Salted hashes: Unique salt per password (automatically generated by bcrypt)
• Password policy: Minimum 8 characters, 1 uppercase, 1 number required
• No plaintext storage: Passwords never stored in logs, backups, or memory dumps

Role-Based Access Control (RBAC)

• 5 User Roles: Admin, Lawyer, Paralegal, Client, Enterprise Admin
• Granular permissions: Read, Write, Delete, Admin (per resource type)
• Principle of Least Privilege: Users granted minimum permissions needed for their role
• Permission auditing: All permission changes logged with timestamp and admin ID

Multi-Factor Authentication (MFA) — not yet available

• Status — not yet available: Multi-factor authentication is on the roadmap. It is NOT implemented today, and this page will not claim it until it ships.
• Today's protection: Brute-force rate limiting (5 attempts / 15 minutes) and bcrypt password hashing at cost factor 12 (verified in code).
• Enterprise: No MFA requirement can be offered until MFA ships. Enterprise contracts must not rely on it.
• Account recovery: Handled through the password reset flow; MFA recovery codes will follow MFA itself.

Session Management

• JWT tokens: HS256 algorithm with 7-day expiry, HTTP-only cookies
• Session revocation: Instant logout on password change or security events
• IP tracking: Login IP addresses logged for security audits
• Concurrent sessions: No per-user session cap is enforced today; tokens expire on their own schedule.

Cloud Infrastructure

• Hosting: Kendi yönettiğimiz sunucuda Docker konteyner + Nginx ters vekil (AB / Finlandiya)
• Database: PostgreSQL 16 (kendi yönettiğimiz konteyner), en az yetkili uygulama rolü — çalışma zamanı rolünün DDL/DROP yetkisi yoktur; günlük otomatik yedekleme zamanlayıcısı
• CDN / WAF: Cloudflare — DDoS koruması ve Web Uygulama Güvenlik Duvarı
• Coğrafi yedeklilik: Şu anda tek bölge (AB). Çoklu bölge replikasyonu yol haritasındadır — henüz mevcut değildir.

Network Security

• Firewall: Host-level default-deny rules (ufw) with Cloudflare WAF in front.
• DDoS mitigation: Cloudflare DDoS protection (Layer 3/4 and Layer 7)
• Rate limiting: Authentication endpoints: 5 attempts per 15 minutes (brute-force protection). General API: 60 requests per minute.
• AI egress guard: Requests containing secrets or source code are rejected with 422 BEFORE reaching any AI provider (verified in production).
• Network isolation: The database is reachable only from the internal container network; no port is exposed publicly.

Backup and Disaster Recovery

• Automated backups: Daily full database backup via a scheduled timer.
• Deployment rollback: A snapshot of the running image is taken before every deployment; if the snapshot fails, the deployment does not proceed.
• Recovery: Restore from the latest daily backup. Point-in-time recovery (PITR) is on the roadmap — not available today.
• RTO/RPO: No recovery objective is published yet; we do not state a number until it is measured in a drill.
• Monitoring: Automated reality probe every 30 minutes (home page plus internal endpoints) and container health checks.

24/7 Security Monitoring

• Logging: Application and access logs are aggregated on the server. Splunk is not used.
• Alerting: Autonomous monitoring units record a finding on a failed probe. There is no PagerDuty integration.
• Anomaly detection: Machine learning-based anomaly detection for login patterns
• Audit logs: All actions logged with user ID, IP address, timestamp, and action type
• Log retention: Security logs retained for 1 year (2 years for Enterprise)

Incident Response

• Response team: Dedicated security incident response team (on-call 24/7)
• Incident playbooks: Documented procedures for 12 common security scenarios
• Notification timeline: Users notified within 72 hours of confirmed data breach (GDPR requirement)
• Post-incident review: Root cause analysis and remediation plan within 7 days
• Forensic analysis: Full forensic investigation for all security incidents

Threat Intelligence

• Vulnerability feeds: Subscribed to CVE, NVD, and CISA alerts
• Threat sharing: Member of FS-ISAC (Financial Services Information Sharing and Analysis Center)
• Patch management: Critical patches applied within 48 hours, routine patches within 14 days

Security Testing

• Penetration testing: Annual third-party penetration tests by certified ethical hackers (CEH)
• Vulnerability scanning: Weekly automated scans with Qualys/Tenable
• Code reviews: Manual security code reviews for all major releases
• SAST/DAST: Static and Dynamic Application Security Testing in CI/CD pipeline
• Bug bounty program: HackerOne program with rewards up to $10,000

Secure Development Lifecycle

• Secure coding standards: OWASP Top 10 compliance enforced in code reviews
• Dependency scanning: Automated scanning for vulnerable dependencies (Snyk, Dependabot)
• Security training: Quarterly security awareness training for all developers
• Git security: Signed commits required, secrets scanning with GitGuardian
• Code signing: All production releases signed with GPG keys

Industry Certifications

Legal Industry Standards

• Attorney-Client Privilege: All communications encrypted and access-controlled
• Bar Association Rules: Compliant with ABA Model Rules of Professional Conduct (Rule 1.6)
• Data Residency: Option to store data in specific jurisdictions (EU, US, Turkey)
• E-Discovery Ready: Tamper-proof audit trails for litigation support
• Document Retention: Configurable retention policies (1-10 years)