ISO 27001 / 27701 Information Security and Privacy

1. Identity of the Data Controller

The data controller is Raze Security, a technology company operating under the laws of the Republic of Türkiye. Contact: [email protected]

2. Personal Data, Purposes and Legal Grounds

• Contact form: First name, last name, email address, phone number, company name and the content of your message. Processed to respond to your request and to carry out quotation and pre-contract steps, based on Articles 5/2-c (directly related to the establishment of a contract) and 5/2-f (legitimate interest) of KVKK.
• Demo request: Full name, company name, business email address, phone number, your notes and the product you requested. Processed to schedule the product demo and contact you, based on Articles 5/2-c and 5/2-f of KVKK.
• Newsletter subscription: Email address, language preference, sign-up and confirmation dates and the IP addresses used for them. Processed to send newsletters and informational emails based on your explicit consent (KVKK Art. 5/1) and your approval under Law No. 6563 on the Regulation of Electronic Commerce. Consent and opt-out records are kept based on Article 5/2-ç of KVKK because of the evidentiary obligation under that law.
• Form security: IP address and the browser and usage information assessed by Google reCAPTCHA. Processed to prevent automated and malicious submissions, based on Article 5/2-f of KVKK (legitimate interest).

3. Retention Periods

• Contact form and demo requests: 2 years from the date the request is received. Records are deleted automatically when this period ends. If your request leads to a contract, the retention periods required by the applicable legislation apply.
• Newsletter subscription: For as long as your subscription lasts. When you unsubscribe you are removed from the mailing list immediately. Your consent and opt-out records are kept for 3 years after the consent ends and are then deleted.
• reCAPTCHA verification results are not stored by us.

4. Transfer of Personal Data

Where necessary, your personal data may be transferred to legally authorized public institutions and to our legal advisors under Article 8 of KVKK. The forms on our website rely on the service providers below. Transfers to these providers, whose servers are located abroad, are made under the conditions and safeguards set out in Article 9 of KVKK:

• Cloudflare, Inc. (USA): website infrastructure, form delivery and storage of form records
• Twilio Inc. / SendGrid (USA): email delivery
• Google LLC (USA): form security with reCAPTCHA
• DigitalOcean, LLC (server located in Frankfurt, Germany): website hosting and listing of form records

5. Method of Collection

Your personal data is collected by automated means and electronically through the forms on this website.

6. Your Rights Under KVKK

Pursuant to Article 11 of KVKK, you have the following rights as a data subject:

• To learn whether your personal data is being processed
• To request information if it has been processed
• To learn the purpose of processing and whether the data is being used for that purpose
• To learn the third parties to whom the data has been transferred, domestically or abroad
• To request correction if processed incompletely or incorrectly
• To request deletion or destruction under the conditions in Article 7 of KVKK
• To request notification of correction, deletion or destruction to third parties
• To object to a result emerging against you due to analysis through automated systems
• To request compensation for damages incurred due to unlawful processing

You can submit your request to [email protected] in writing, or by registered electronic mail (KEP), secure electronic signature, mobile signature or from the email address you previously provided to us and that is registered in our systems, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller. Requests are concluded free of charge within 30 days at the latest.

7. Unsubscribing from the Newsletter

You can unsubscribe from the newsletter at any time, without giving a reason and free of charge, using the "unsubscribe" link in every newsletter email or by writing to [email protected].

1. Data Controller

Within the scope of Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by Raze Security in the capacity of data controller for the purposes explained below.

2. Personal Data Processed

The following categories of personal data may be processed within the scope of our website and services:

• Identity information (first name, last name)
• Contact information (e-mail, phone)
• User transaction information (log records, IP address)
• Technical information shared within the scope of the service

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Provision and execution of services
• Responding to communication requests
• Fulfilling legal obligations
• Improving service quality

4. Transfer of Personal Data

Your personal data may be transferred to our service providers and, in case of legal obligation, to authorized institutions, in accordance with the conditions specified in Articles 8 and 9 of KVKK.

5. Retention Periods

Personal data submitted through the forms on our website is kept for the periods stated in the Information Notice: contact and demo requests for 2 years, newsletter records for as long as the subscription lasts, and consent and opt-out records for 3 years after the consent ends. Data whose retention period has expired is deleted or anonymized.

6. Data Security

Necessary technical and administrative measures are taken to ensure the security of your personal data. Your data is protected against unauthorized access, loss and alteration.

7. Your Rights Under KVKK

Pursuant to Article 11 of KVKK, you have the following rights:

• To learn whether your personal data is being processed
• To request information if it has been processed
• To learn the purpose of processing and whether the data is being used for that purpose
• To learn the third parties to whom the data has been transferred, domestically or abroad
• To request correction if processed incompletely or incorrectly
• To request deletion or destruction within the framework of the conditions stipulated in Article 7 of KVKK
• To request notification of correction, deletion or destruction to third parties
• To object to a result emerging against you due to analysis through automated systems
• To request compensation for damages incurred due to unlawful processing

To exercise your rights, you can contact [email protected].

1. General

This website and the services provided relate to the cybersecurity consulting and product services offered by Raze Security. All visitors using the site are deemed to have accepted the following conditions.

2. Scope of Services

Raze Security offers penetration testing, source code analysis, red team operations, security consulting and training services. All services are performed only on systems authorized by the customer.

3. Product Platforms

VulnCrypt and VulnFlow products within Raze Security (including VulnFlow's built-in razeSAST and ZFPScan modules) are subject to separate terms of use. The terms of the respective platforms apply.

4. Intellectual Property

This website and its contents are the intellectual property of Raze Security. Unauthorized copying, distribution or use is prohibited.

5. Disclaimer

The information presented on the website is for general informational purposes. Raze Security is not liable for any damages arising from the use of this information.

6. Changes

These terms may be modified without prior notice. The most recent terms are always published on this page.

1. Company Information

Raze Security is a technology company operating under the laws of the Republic of Türkiye. Tax number, trade registry number and other corporate information are provided upon request.

2. Competent Court

In any disputes related to Raze Security, the Courts and Enforcement Offices of Istanbul shall have jurisdiction. Turkish law applies.

3. Limitation of Liability

Raze Security's liability under its services is limited to the amount specified in the relevant agreement. It is not responsible for indirect, incidental or consequential damages.

4. Force Majeure

Raze Security accepts no liability where it is unable to perform its obligations due to natural disasters, war, epidemic, cyber attack or other force majeure events.

5. Notices

Official notices to Raze Security shall be sent via [email protected] or the registered company address.

1. Overview

Our website does not use advertising or marketing cookies. No analytics or advertising tools that track visitor behaviour (e.g. Google Ads, LinkedIn Insight Tag) are loaded on our site.

2. Technologies We Use

• Essential security cookies: cookies set by Cloudflare for site security and bot protection (e.g. __cf_bm).
• Form security: when you submit the contact, demo request or newsletter form, Google reCAPTCHA v3 is loaded to prevent abuse. Google cookies may be used in the process.
• Preference storage: your cookie choice is stored in your browser's local storage (localStorage).
• Third-party content: Google Maps on the contact page is loaded only if you consent or choose to view the map. Google cookies may be used once it loads.

3. Manage Your Preferences

Choosing “Reject” on the cookie banner prevents third-party content such as maps from loading automatically. To change your choice, clear this site's data in your browser or manage cookies in your browser settings.

4. Third-Party Policies

Google Privacy Policy · Cloudflare Privacy Policy

1. Service Definition

This page sets out the general framework of the corporate cybersecurity consulting and software platform services provided by Raze Security.

2. Account and Access

Access to our customer portal and product platforms is limited to authorized users following a signed service agreement. Account security and access management is the customer's responsibility.

3. Service Level Agreement (SLA)

Response times, uptime commitments and escalation procedures are defined separately in each agreement.

4. Pricing

Service fees are determined in separate contracts based on scope and duration. Invoices may be issued in TRY or USD. Payment terms are specified in the agreement.

5. Term and Termination

Contracts may be terminated under the conditions specified in their respective clauses. Data retention, return and transfer periods following termination are applied per the agreement.

6. Confidentiality

All information shared during the service period is covered by a mutual non-disclosure agreement (NDA) signed between the parties.

1. Code of Ethics

Raze Security operates with the principles of honesty, transparency, protection of customer interests, and full compliance with applicable laws.

2. Information Security Policy

We protect customer data and corporate assets through an ISO 27001-certified Information Security Management System (ISMS).

3. Professional Responsibility

Offensive security tests are performed only within written authorization. Our team holds internationally recognized certifications such as CISSP, OSCP, OSCE, CRTO.

4. Partner Relations

We expect our partners to adhere to our code of ethics, confidentiality standards and data protection policies. Security criteria are prioritized in the supplier selection process.

5. Diversity and Inclusion

Equal opportunity is observed in all hiring, promotion and evaluation processes. We have zero tolerance for discrimination based on gender, age, ethnicity or belief.

6. Sustainability

To reduce the environmental impact of our operations we track our carbon footprint, support hybrid/remote work and apply a paperless-office policy.