SEC-01
Application & Code Security (OWASP Standards)
Every input is validated server-side with strict Zod schemas. Parameterized ORM queries, Origin verification, and Content Security Policies (CSP) protect against SQLi, XSS, and CSRF.
Trust & Security Center
Security
How we protect your data in every piece of software we build, explained in plain language.
SEC-02
Authentication & Role-Based Access Control (RBAC)
Passwords are hashed with high-cost scrypt and verified in constant time. Sessions are backed by SHA-256 database tokens with least-privilege checks on every route.
SEC-03
Tenant Isolation & Private Object Storage (S3 / R2)
Client files are never stored in public buckets; uploads undergo magic-byte binary inspection and are served exclusively via short-lived presigned URLs to authorized users.
SEC-04
KVKK / GDPR Compliance, NDA & 100% IP Ownership
We sign mutual NDAs before discovery calls. Upon completion, 100% of source code, database schemas, and deployment keys are transferred to your organization.
Technical Security Controls Matrix
Standard security layers active across BAYAKA Yazılım web platforms and client portals.
Cryptography & Password Security
TLS 1.3 in transit, scrypt password hashing, SHA-256 hashed session and reset tokens
Access & Session Governance
7-tier RBAC permission matrix, automatic lockout after 5 failed logins, instant session revocation
Bot & Abuse Mitigation
Salted IP-hash rate limiting, Cloudflare Turnstile verification, and invisible honeypot traps
File Upload Hardening
Magic-byte binary signature inspection, path-traversal sanitization, and PUT-only R2 CORS
Immutable Audit Trail
Timestamped AuditLog records across administrative, quote, project, and security actions
Data Privacy & Retention
Automated retention purge tools and built-in KVKK / GDPR data subject request workflows
Frequently Asked Questions
Answers to common technical and process questions.
How does your software development process work?
We start with discovery and technical scoping, validate UI/UX prototypes with you, and build in transparent two-week sprints while sharing live progress through your client portal.
Who owns the source code and intellectual property?
Upon project completion and final payment, 100% of the source code, database schemas, and deployment documentation are transferred to your company.
How do you estimate project cost and delivery time?
We prepare an itemized, transparent proposal based on scope, user roles, integrations, and timeline. You can also use our interactive Price Calculator for an instant ballpark range.
How do you handle security, NDAs, and data privacy (KVKK/GDPR)?
We are happy to sign an NDA before our first discovery call. All systems include RBAC authorization, encrypted sessions, rate limiting, and privacy compliance by design.
Do you provide post-launch support and maintenance?
Yes. Beyond post-launch warranty fixes, we offer monthly SLA plans covering uptime monitoring, security patches, backups, and continuous feature development.
Can you integrate with our existing ERP, CRM, or payment providers?
Yes. We build reliable integrations with REST/GraphQL APIs, webhooks, payment gateways, e-invoicing, and enterprise ERP/CRM platforms.
Have an idea? Let's talk.
Tell us what you need — we'll get back to you within one business day.