CRY Trust Center: Defensive Software & Infrastructure Standards

At CRY, we adhere to "Secure by Default" and "Least Privilege" principles. In our software systems, only strictly necessary ports, services, and credentials remain exposed.

Rather than claiming unverified third-party certifications or commercial badges, we deliver verifiable, auditable safeguards deployed and tested directly within production environments.

All web communication is encrypted using modern TLS 1.3 and TLS 1.2 protocols. Deprecated ciphers and legacy protocol versions are disabled at the server layer.

Sensitive operational credentials, third-party API keys, and access tokens stored in databases are encrypted using AES-256-GCM or AES-256-CBC with application-level key management.

Automated database snapshots are generated daily and transferred to encrypted, off-site storage environments isolated from the primary application server.

We regularly conduct restoration drills (restore tests) to verify that backup snapshots remain uncorrupted and can be brought online swiftly when required.

Failed authentication attempts, privileged role changes, 404/403 volume anomalies, and unhandled server exceptions are recorded with precise timestamps.

Sensitive customer details, passwords, and payment information are strictly masked and scrubbed before log entries are committed to disk.

Composer and npm dependencies are regularly cross-checked against vulnerability databases (CVE, GitHub Advisory) and promptly patched.

We practice a minimal dependency philosophy, avoiding unmaintained, redundant, or bloated third-party packages in project repositories.

When an anomaly or vulnerability is suspected, the affected component is immediately isolated and relevant administrative sessions are revoked.

We conduct thorough log-based root-cause analysis, deploy verified patches, and deliver transparent technical post-mortems to impacted stakeholders.

For systems hosted on client-owned servers or private cloud accounts, operating system updates, network firewalls (UFW/iptables), and SSH key management remain within the infrastructure owner’s domain.

CRY is responsible for the application-level security of delivered code and for supplying validated production hardening configurations.

Code changes are developed and verified in isolated staging environments before production rollout. Automated PHPUnit suites protect business logic and regression boundaries.

Production deployment pipelines strip source maps, disable debug tooling, and ensure environment variables remain strictly non-public.

If you identify a security vulnerability within our systems or web properties, please report it privately to security@cry.com.tr before public disclosure.

We commit to acknowledging responsible disclosure reports within 48 hours and expediting verified remediations transparently.

Personal information collected through forms is handled transparently with explicit consent notifications and clear processing disclosures.

Granular cookie preferences (essential vs. analytical) are respected; analytics tags do not fire until user consent is explicitly recorded.

Administrative credentials must maintain high entropy and never be shared across multiple team members.

Workstations used for administrative access must maintain active OS updates and team members should exercise vigilant awareness against phishing attacks.