Security & privacy
Security and privacy
This page describes the practices we actually follow. We answer vendor security questionnaires on request and state exactly which controls are in place.
Access and accounts
- Every person uses their own account with a defined role; there are no shared logins.
- Least privilege: access is granted per system and per project, and removed when it is no longer needed.
- Production changes need explicit approval, and deployments pass automated tests and gates first.
Secrets and credentials
- Credentials are never stored in source code, repositories or logs.
- Secrets live in the environment configuration of each system and are scoped to the service that needs them.
- Client credentials stay in the client’s own secret store whenever possible.
Handling client data
- We collect and process only the data a project needs.
- Where possible, we work inside your environment and accounts rather than copying data to ours.
- At the end of a project, data is returned or deleted as agreed in the contract.
- Personal data is processed under KVKK (Türkiye) and, for clients in the EU, the GDPR; a data processing agreement can be part of the contract.
Secure development
- Code review and automated tests before merge and deployment.
- Dependencies are pinned to exact versions and updated deliberately.
- Infrastructure changes are recorded, with a rollback path.
Use of AI
- We do not use client data to train models.
- AI providers are chosen together with the client; they can be replaced, or models can run locally.
- AI-generated text is reviewed, and figures in it come from deterministic code.
Reporting a security issue
Write to security@zerentechnologies.com. We confirm receipt and keep you informed until the issue is resolved. Our security.txt lists the same contact.
For vendor assessments, a pre-completed security questionnaire (CAIQ-Lite and SIG Lite domains) and our data processing agreement template (English and Turkish) are ready; write to security@zerentechnologies.com. We also complete your own questionnaire. The questionnaire states plainly which controls are in place and which are not.
Have a project in mind?
Send a short description. If you need a mutual NDA first, we will send ours before you share details.