How is encryption handled?

Data is encrypted in transit with TLS 1.3. Payment provider credentials, integration keys and payout account details are encrypted at the application layer with AES-256-GCM; passwords are stored with Argon2id, and analytics records keep only one-way digests of e-mail and IP. Backups are encrypted before they leave the server. Field-level encryption of customer identity and address data is on our roadmap.

Can Daras staff access my data?

There is no default access. When support is needed, an authorised Daras administrator opens a time-limited support session with a written reason; opening and closing are written to the audit log, and access ends on its own when the time is up.

Can I see your audit reports?

Security documentation (architecture summary, data processing inventory, penetration test status) is shared on corporate request under a confidentiality agreement; documents are added to the customer portal as independent certification processes complete.

Can I delete my data?

Yes. Send your deletion request to the support team; your data is deleted except records we are legally required to keep, such as invoices and payments. KVKK requests are answered within the statutory period, 30 days at most.

What happens in a disaster?

Data is backed up regularly and restore procedures are tested. Our disaster recovery targets are shared transparently with corporate customers.

Who are your third-party providers?

Cloudflare (CDN and security layer), iyzico and contracted payment institutions, Sentry (error monitoring). The current supplier list is shared on request.

How will I learn about a security incident?

Outages and incidents are published on the status page; subscribe to incident notifications to get them by email. Breaches in KVKK scope are notified within 72 hours.

Security · Compliance · Transparency

Your data, secure by default.

AES-256-GCM encrypted secrets, append-only audit trail, security gates on every push and round-the-clock monitoring. Security is the foundation of Daras, not an add-on; independent audit, penetration testing and field-level encryption of customer data are on our roadmap.

CI quality and security gates

80+

Zero-downtime deploys

24/7

Audit log

Append-only

Active monitoring

24/7

Certifications

Certification path,

Documents will be shared on this page as certification processes complete. We provide security documentation on request under a confidentiality agreement.

Information security management

ISO 27001

Our information security management system is built to ISO 27001 requirements; independent certification is on our roadmap.

On the roadmap

Independent audit report

SOC 2 Type II

Processes and controls are designed around SOC 2 principles; an independent Type II audit is planned.

Planned

Card data handling standard

Payment security standard

Card data never touches Daras infrastructure; payments are tokenized and processed through payment-security certified payment institutions.

Via payment institutions

Personal data protection

KVKK

KVKK compliance is actively maintained: data processing inventory, disclosure notices and a data-subject request channel are in place.

KVKK

Three pillars

Infrastructure,

The Daras security model rests on three pillars — each pillar is validated by an independent audit and evidence.

Infrastructure

Data centresGermany (EU)
Cloud providerServers located in Türkiye
Secret encryptionAES-256-GCM
In transitTLS 1.3 only
Backup3× / 4 hours
Disaster recoveryRedundant

Access

SSOSAML 2.0 / OIDC
Two-factorTOTP (team) · passkey (customers)
RBACGranular + IP fence
AuditFull · immutable
Data export48 hours
Role-based accessActive

Contract

Status transparencyLive page
Service termsBy contract
Data ownershipCustomer
DPAStandard included
Response timeTarget by severity
MSATurkish / English

FAQ

Questions your

The 8 questions we receive most often in RFPs. For deeper technical questions, write to security@platform.contactEmailDomain.

All production data is hosted in a data centre in Germany (EU) and processed under KVKK; a move to Türkiye is planned.

Get started

Try it in your trial store, go live when you are ready.

The migration team moves your products, customers, orders and theme; a 301 redirect map keeps your SEO intact.

Start free Developer portal