Information Security Policy (BGYS)
Statement of alignment with ISO/IEC 27001 Information Security Management Standards, air-gapped DevSecOps pipelines, and NATO/SSB sensitive data handling principles.
1. Purpose & Scope
At Anylogy (`https://anylogy.com/`), protecting the confidentiality, integrity, and availability of mission-critical enterprise and defense information assets is our highest operational priority. This Information Security Policy applies to all principal architecture, data engineering, sovereign cloud, and DevSecOps engagements delivered from our Istanbul and London hubs.
2. Core Information Security Commitments (ISO/IEC 27001 Aligned)
- 01 · Confidentiality, Integrity & Availability (CIA Triad): We protect all corporate, regulatory, and defense-related information assets against unauthorized access, alteration, disclosure, or destruction.
- 02 · Air-Gapped & Sovereign Execution: All database tuning, ELT/ETL pipeline engineering, and DevSecOps automation execute 100% inside the client's air-gapped on-premise infrastructure or accredited sovereign cloud VPC. Zero client data is ever transmitted to external third-party servers.
- 03 · NATO, SSB & National Data Protection Compliance: We strictly adhere to Turkish Presidency of Defense Industries (SSB) data security directives, UK Official-Sensitive handling rules, KVKK Law No. 6698, and UK/EU GDPR.
- 04 · Cryptographic Controls & Data Masking: We enforce Transparent Data Encryption (TDE), TLS 1.3 in transit, hardware security module (HSM) key management, and automated static/dynamic data masking across all test and sandbox environments.
- 05 · DevSecOps & Container Hardening (SSTT 2.0 B14.07 & B14.12): Every CI/CD pipeline integrates automated SAST, DAST, container image signing, dependency vulnerability scanning, and CIS-hardened Packer Golden AMIs.
- 06 · Least-Privilege Access & Auditability: Role-Based Access Control (RBAC), multi-factor authentication (MFA), and immutable database/infrastructure audit logs are enforced across all systems.
- 07 · Continuous Risk Assessment & Incident Readiness: We conduct proactive vulnerability assessments, architectural threat modeling, and continuous improvement of our Information Security Management System (ISMS).
Security & Compliance Contact: For security questionnaires, SSB YETEN/EYDEP audits, or ISO/IEC 27001 documentation requests, contact [email protected] or visit our Corporate Identity (Kurumsal Künye) page.