Security and Compliance
What it takes to be a supplier to regulated organizations.
We work with banks, payment institutions, holding companies and critical infrastructure operators. Passing their supplier audits means treating security and compliance as operating discipline, not as a marketing headline. Our ISO/IEC 27001 certified information security and ISO 9001 certified quality management systems are the institutional frame of that discipline. This page summarizes the information your organization will need in its supplier assessment process.
Certifications and standards
We support our clients’ internal audits and information systems audits with documents, evidence and on-site access.
| Standard / framework | Status |
|---|---|
| ISO/IEC 27001 Information Security Management System | Certified. Certificate number and validity date shared on request. |
| ISO 9001 Quality Management System | Certified. Certificate number and validity date shared on request. |
| KVKK (Turkey’s data protection law) compliance program | Data controller registered with VERBİS; privacy notice, data processing and retention/destruction policies. |
| Supplier compliance with the information systems communiqués of BDDK (banking regulator) and SPK (Capital Markets Board) | The control set assessed in client audits; compliance with outsourcing requirements. |
| Technopark R&D center | Kahramanmaraş Teknokent. |
Secure development lifecycle
Threat modeling at design
A threat model for critical flows; security requirements are part of the architecture assessment report.
Code security
Mandatory code review, static analysis, dependency and license scanning, secret leak checks.
Environment separation
Development, test, acceptance and production environments are separated; production data is masked in test environments or synthetic data is used.
Release management
Approved, traceable, reversible releases; segregation of duties applies to the release process as well.
Penetration testing
Independent penetration testing before every critical delivery is standard; no go-live until findings are closed.
Security updates
Defined patch windows for dependencies and infrastructure components; an emergency response procedure for critical vulnerabilities.
Access and identity management
- Least privilege; role-based access; privileged access is logged.
- Access to client environments only through channels the client defines, with named accounts and time-limited authorization.
- Multi-factor authentication; access provisioning and revocation on joining and leaving.
- Remote work security: managed devices, encrypted disks, VPN / zero-trust access.
Data handling and confidentiality
- Data classification
- Client data, personal data and project data are classified; processing purpose and retention period are defined.
- Client data principle
- Client data is processed only in the environment and for the purpose the client has approved in writing; returned or securely destroyed at project end.
- Data processor obligations
- Data processor agreements under KVKK, privacy notice and data subject rights processes; cross-border transfer only through mechanisms permitted by law.
- Confidentiality agreements
- All employees and subcontractors are bound by confidentiality undertakings; a project-level NDA is standard.
- Subcontractor management
- Use of subcontractors is subject to client approval; the same security obligations are passed on by contract.
Business continuity and incident management
- A business continuity plan for critical business processes; backup and recovery objectives (RPO/RTO) are defined in project and service contracts.
- Security incident management procedure: detection, classification, response, client notification within 24 hours, root cause analysis and a corrective action report.
- Response under SLA in value partnerships and product support; response and resolution times defined by severity.
Policies and documents
- Information Security PolicyPDF
- KVKK Privacy Notice and Personal Data Processing PolicyPDF
- Information Society ServicesPDF
- Cookie Policy→
- Supplier assessment document setOn request, under NDA — info@karyabilisim.com
A document set for your supplier assessment.
We provide ready answers to standard questionnaires and documents for your procurement and information security teams.