Trust Center

Everything you need to know about our platform's security, compliance, and transparency. Full alignment with industry-leading security standards.

🛡️SOC 2

🏅ISO 27001

🇪🇺GDPR

💳PCI DSS

⭐CSA STAR

🏥HIPAA

🔐NIST

🇹🇷KVKK

All Systems Operationalstatus.cyber-sec-pro.com →

End-to-End Encryption

AES-256 for rest, TLS 1.3 for transit. Zero-knowledge scan results. Key rotation with forward secrecy.

Isolated Infrastructure

Each scan runs in an isolated container. No cross-tenant access. Dedicated instances for Enterprise plans.

SOC 2 Type II Controls

Infrastructure designed according to SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Privacy).

Immutable Audit Logging

Complete and immutable audit trails of all actions. SIEM integration. WORM storage for compliance.

MFA, SSO & Zero Trust

Multi-factor authentication via TOTP/WebAuthn. SAML 2.0, OAuth 2.0, OpenID Connect SSO. RBAC + ABAC.

Continuous Patching

Critical security patches applied within 24 hours. CVE databases updated hourly. Automated SBOM generation.

Data Minimization

Data minimization compliant with GDPR Article 5(1)(c). Automated data lifecycle management.

Real-Time Threat Detection

ML-powered anomaly detection. Real-time IDS/IPS. Automated threat intelligence feed integration.

security.txt (RFC 9116)

Our security contact file, fully compliant with IETF RFC 9116. Automatically discovered by search engines and security researchers.

# CyberSec Pro Security Policy

# RFC 9116 Compliant

Contact: mailto:[email protected]

Contact: https://cyber-sec-pro.com/trust-center#responsible-disclosure

Encryption: https://cyber-sec-pro.com/.well-known/pgp-key.txt

Acknowledgments: https://cyber-sec-pro.com/trust-center#acknowledgments

Policy: https://cyber-sec-pro.com/trust-center#responsible-disclosure

Hiring: https://cyber-sec-pro.com/careers

Preferred-Languages: en, tr

Canonical: https://cyber-sec-pro.com/.well-known/security.txt

Expires: 2027-07-31T23:59:59.000Z

Direct access to security.txt PGP Key

Responsible Disclosure & Bug Bounty

1Scope

In-Scope:

cyber-sec-pro.com (sub-domains)
app.cyber-sec-pro.com (SaaS platform)
api.cyber-sec-pro.com (REST & GraphQL API)
Mobile Apps (iOS / Android)
Open Source Components (GitHub)

Out-of-Scope:

Social engineering & phishing
DDoS / DoS
Physical security
Third-party services

2Reporting Channel

Please report security vulnerabilities encrypted with PGP to: [email protected]

Report template:

Subject: [SECURITY] Short description
Affected asset: URL / endpoint
Vulnerability type: (XSS, SQLi, IDOR, etc.)
Steps to reproduce: (1, 2, 3...)
Impact: (Data leak, Privilege escalation, etc.)
CVSS score (optional)
PoC / Screenshots

3Response SLA

First response: ≤ 24 hours
Status update: ≤ 72 hours
Fix or exception: ≤ 90 days

4Safe Harbor

No legal action will be taken for reports complying with this policy
Reporter's identity will be kept confidential
Will be added to Hall of Fame after remediation
Testing without written permission is prohibited

$Bug Bounty Reward Table

Severity	CVSS	Reward	Example Findings
Critical	9.0–10.0	$5,000 – $15,000	RCE, Authentication Bypass, SQL Injection, Data Breach
High	7.0–8.9	$2,000 – $5,000	Privilege Escalation, SSRF, Stored XSS
Medium	4.0–6.9	$500 – $2,000	CSRF, IDOR, Information Disclosure
Low	0.1–3.9	$100 – $500	Reflected XSS, Open Redirect, Missing Headers

Compliance Frameworks

10/10 Compliant

SOC 2 Type II✓ Compliant

Annual audit — Ernst & Young

GDPR✓ Compliant

Full compliance Art. 6, 17, 25, 28, 32, 35

ISO 27001:2022✓ Compliant

Certified — BSI Group

ISO 27701✓ Compliant

Privacy Information Management

NIST CSF 2.0✓ Compliant

Full framework alignment

PCI DSS v4.0✓ Compliant

Level 1 Service Provider

HIPAA✓ Compliant

BAA available — PHI encryption

KVKK✓ Compliant

Turkish Personal Data Protection Law

CCPA/CPRA✓ Compliant

California Consumer Privacy Act

CSA STAR Level 2✓ Compliant

Cloud Security Alliance Certification

Incident Response SLA

Our incident response procedures compliant with ISO 27035 and NIST SP 800-61 Rev.2:

Priority	Detection	Response	Notification	Resolution
P0 — Critical	≤ 15 min	≤ 30 min	≤ 1 hour	≤ 4 hours
P1 — High	≤ 30 min	≤ 1 hour	≤ 4 hours	≤ 24 hours
P2 — Medium	≤ 1 hour	≤ 4 hours	≤ 24 hours	≤ 72 hours
P3 — Low	≤ 4 hours	≤ 24 hours	≤ 72 hours	≤ 30 days

Sub-processors

Third-party providers processing data under GDPR Article 28(2). All sub-processors have signed a DPA (Data Processing Agreement).

Provider	Purpose	Location	DPA
Stripe, Inc.	Payment processing	ABD (EU SCC + DPF)	✓ Signed
Vercel, Inc.	Frontend hosting & CDN	Global Edge (EU SCC)	✓ Signed
Cloudflare, Inc.	DDoS protection, WAF, CDN	Global (EU SCC + DPF)	✓ Signed
AWS (Amazon)	Backend infrastructure, S3 storage	EU (Frankfurt, eu-central-1)	✓ Signed
PostgreSQL (Supabase)	Relational database	EU (Frankfurt)	✓ Signed
SendGrid (Twilio)	Transactional email	ABD (EU SCC)	✓ Signed
Sentry	Error tracking and monitoring	ABD (EU SCC)	✓ Signed

Last updated: July 2026. 30 days prior notice is provided for sub-processor changes.

Data Processing Agreement (DPA)

We provide a Data Processing Agreement (DPA) for all customers under GDPR Article 28. The DPA includes EU Standard Contractual Clauses (EU SCC 2021) and UK IDTA.