Security principles

At KUTBU, we care about keeping your information safe when you use our website and services. This page explains the core security principles we apply and the steps you can take to protect yourself. No system is entirely free of risk; that is why we treat security not as a one-off task but as a process we review continuously.

All connections to our website and services are encrypted with TLS (HTTPS); unencrypted HTTP requests are automatically redirected to HTTPS. - HSTS (HTTP Strict Transport Security) ensures that your browser accesses our site only over an encrypted connection. - A content security policy and similar HTTP security headers provide additional protection against attacks such as our pages being framed by other sites and content injection. - We regularly review our encryption configuration against current security recommendations.

Our contact, newsletter and similar forms are protected against abuse: - Every form submission is verified with a short-lived security token against cross-site request forgery (CSRF). - Rate limiting is applied to forms and sensitive actions; the IP address is processed transiently for this purpose. - Submitted data is validated on the server; forms ask only for the information that is needed. Form submissions are not stored in a database on the website; they are delivered to our team by e-mail.

Access to our systems and data is granted on the principle of least privilege: each team member can access only the data and systems required for their role. Permissions are updated when roles change and removed when no longer needed. Strong authentication is used for administrative access. Access to systems and significant actions are logged; these logs are used to detect security incidents and to meet obligations arising from the applicable legislation.

Regular backups are taken of the data required for our services, and backups are kept in access-restricted environments. We regularly review our processes for restoring from backups.

When a security incident is suspected, we assess it promptly, take the measures needed to limit its impact and work to resolve its root cause. In the event of a breach affecting personal data, notifications are made to the Personal Data Protection Board and, where required, to the affected individuals in accordance with Law No. 6698 on the Protection of Personal Data.

Our website has no online checkout (cart or payment) page, and our website does not collect or store card data. - Orders are taken by quote; payments can be made by bank transfer/EFT/FAST or by card through a payment link from a licensed payment institution that we send to you. - Card payments take place on the licensed payment institution's secure payment page and are completed with 3D Secure verification where supported by your bank. Your card details are not passed to KUTBU and are not kept on KUTBU systems. - KUTBU will never ask you for card details, card PINs, verification codes or account passwords by e-mail, phone, SMS or messaging apps.

Be careful with fake e-mails, text messages or calls that appear to come from KUTBU: - Before clicking a link, check the sender's address and whether the link really belongs to the kutbu.com domain. - Do not trust messages that pressure you to act quickly or ask for payment details or passwords. - Do not give personal or card details to anyone who introduces themselves as a bank, a public official or a KUTBU employee and asks for them. - If you receive a suspicious communication, report it to merhaba@kutbu.com.

- Use a different, long and hard-to-guess password for each service; a password manager can help. - Enable two-step verification where available. - Never share your passwords, card details or the verification codes you receive with anyone. - Keep your operating system, browser and apps up to date and leave automatic updates switched on. - Download apps only from official app stores (such as the App Store and Google Play). - Avoid making payments or signing in on shared devices and untrusted wireless networks. - Check that the address bar shows https and the correct domain name. - Keep the phone number and e-mail address registered with your bank up to date.

If you believe you have found a security vulnerability in our systems, please send the details to merhaba@kutbu.com. Explaining how the issue can be reproduced helps us assess it faster. We take good-faith reports seriously, investigate them and let you know the outcome. While investigating, please do not access, modify or delete other people's data, do not disrupt our services, and do not disclose the vulnerability publicly until it has been fixed.