Skip to content
CyberendX
TR EN
Request a demo Get it from the store

Compliance

Compliance Framework

As a cybersecurity platform, CyberendX is conscious of the sensitivity of the data we process. We structure our operations around both local regulations (KVKK, TÜRKAK) and international standards (GDPR, ISO 27001, SOC 2, NIS2) — and publish our practices openly.

  • KVKK
  • GDPR
  • ISO 27001
  • SOC 2
  • NIS2
  • TÜRKAK

Frameworks

Compliance built into the architecture.

CyberendX treats KVKK + GDPR + ISO 27001 + SOC 2 not as a bolted-on layer but as a foundational part of the platform. Data ownership, audit trails, user rights and operational controls are designed for compliance from day one.

  • KVKK Active compliance

    Turkish Personal Data Protection Law (KVKK)

    CyberendX is carrying out its VERBİS registration process as a data controller under Türkiye’s KVKK (Law No. 6698). All customer data is processed within Türkiye or EU data centers; no transfers to third countries. Transparency notices, retention schedules, and data-subject rights (access, rectification, erasure, portability) are enforced automatically by the platform.

  • GDPR Active compliance

    EU General Data Protection Regulation

    A standard Data Processing Agreement (DPA) is signed for EU customers. Pseudonymization, AES-256 encryption at rest, TLS 1.3 in transit, Right to Erasure (Art. 17), and DSAR workflows are built into the platform. Breach notification targets 72 hours.

  • ISO 27001 On certification roadmap

    Information Security Management System

    We operate against ISO 27001:2022 controls. Risk assessment, asset inventory, access management, and incident response are documented under our ISMS policy. Formal certification with an accredited body is scheduled for 2026.

  • SOC 2 Type I in preparation

    SOC 2 — Security, Availability, Integrity

    All five AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) are mapped. Type I observation has begun with a continuous-audit platform; Type II is targeted 12 months later.

  • NIS2 EU critical-infrastructure framework

    NIS2 Directive (EU)

    For EU critical infrastructure customers (energy, finance, healthcare, public sector) covered by the NIS2 directive, we provide direct support for the required risk management, incident reporting, and supply-chain security obligations.

  • TÜRKAK Local accreditation program

    TÜRKAK Accreditation

    Aligned with cybersecurity testing and certification standards set by TÜRKAK, the Turkish Accreditation Agency. We provide locally accredited solutions for public sector and critical-infrastructure customers in Türkiye.

KVKK Article 11 · GDPR Articles 15–22

Data Subject Rights

You may exercise your data subject rights under KVKK Article 11 and GDPR Articles 15-22 at any time. Requests are answered within 30 days — within 72 hours for urgent cases.

  • Right of Access (GDPR 15)
  • Right to Rectification (GDPR 16)
  • Right to Erasure (GDPR 17)
  • Right to Data Portability (GDPR 20)
  • Right to Object (GDPR 21)
  • No Automated Decision-Making (GDPR 22)

Talk to our compliance team.

Write to us with your questions and data subject requests.

Contact Compliance Team Privacy Policy