Tamga is engineered for regulated industries in Turkey. We publish our infrastructure posture, certifications, data residency options and incident response process here.
SOC 2 Type IIROADMAP
Q3 2026 audit window planned
ISO/IEC 27001ROADMAP
Stage 1 in H1 2026
KVKKACTIVE
Art. 6/7 retention + right to erasure
Data residency & sovereignty
TR: Istanbul (TR-CEN) region on-prem / private-cloud deploy. No request leaves KVKK jurisdiction.
EU: Frankfurt (eu-central-1) region; GDPR Art. 44 compliant data storage.
Self-hosted: Runs in customer's own VPC via Kubernetes + Helm chart; no logs leave the perimeter.
04Secret scanning: pre-commit hook leak detection in CI.
Data control
01Subject erase: DELETE /api/v1/events/subject endpoint for KVKK Art. 7 (right to erasure).
02Retention: policy.data.retention_days (default 90 days, customer-configurable in YAML).
03Hash-only mode: policy.data.hash_findings=true stores only SHA-256 digests.
04DPA (Data Processing Agreement) available; Turkish + English template.
Audit trail
All administrative operations (policy changes, API key creation, user role updates, subject erase requests) are recorded in a hash-chained audit ring. GET /api/v1/audit/verify validates chain integrity; any tamper attempt returns chain_ok=false.
Vulnerability disclosure
Disclosure: support@tamgaproxy.com. Response within 48 hours, coordinated disclosure within 90 days.
