Security & Trust Center
What we do to protect integrity and access — and, just as plainly, what we do not claim.
Infrastructure Security
TLS in transit, application-level encryption for secrets and consent files, tenant-scoped data separation and a region-bound tenant database. Disk-level encryption depends on the hosting configuration.
Cryptographic Integrity
Canonical JSON (sorted keys), SHA-256 proof hashes, RFC 3161 timestamps from the configured authority and Merkle-tree batching — all verifiable without HashEntry.
Identity & Access Control
Role-based access control (RBAC), two-factor authentication (2FA) and scoped API keys.
Operations & Transparency
Audit logging of panel actions, rate limiting and service metrics. HashEntry does not currently hold ISO 27001 or SOC 2 certification and has no published penetration-test report.
Data Minimisation
Consent records contain personal data: an IP address (masked by default; you can choose full, masked, hashed or none), the full user agent, the visitor ID your site supplies and, only if you enable it, a salted device-fingerprint hash. Timestamp authorities receive the SHA-256 digest only.
Sub-processors & Service Providers
Categories of providers present in the product, what they receive and where. Providers apply only when the related feature is enabled. Entries in brackets are finalised at go-live; the binding list is the sub-processor annex of the Data Processing Agreement.
| Subprocessor / Service | Category | Jurisdiction / Region | Data shared / purpose |
|---|---|---|---|
| [Hosting provider] | Hosting (application & database) | [TR / EU — per region] | All platform data. Only the tenant database is region-bound; queues, logs and platform metadata are processed on the platform. |
| Cloudflare | Static hosting / CDN | Global edge network | Serves website, panel and SDK files; receives visitor IP and request metadata. Consent records are not stored there. |
| OpenRouter, OpenAI, DeepL · Ollama (self-hosted) | AI (translation, assistant, chat) | [US / EU — per provider] | Customer document content and chat text, only when AI features are used. End-user consent records are not sent. |
| iyzico, PayTR, Param, Sipay, bank virtual POS | Payment gateways | Türkiye | Billing and payment details of customers; card data is handled directly by the gateway. |
| Paddle, Lemon Squeezy | Merchant of record | [US / EU / UK] | Billing and payment details; these providers act as independent controllers for payments. |
| Paraşüt | E-invoicing | Türkiye | Identity, tax and address details of invoiced customers. |
| Configured RFC 3161 provider | Timestamping (TSA) | Depends on provider | SHA-256 digest only — no personal data. Legal weight depends on the provider and jurisdiction. |
| PostHog (EU) | Panel analytics (if enabled) | European Union | Usage events of panel users. |
| [E-mail provider — not yet selected] | E-mail delivery | [To be completed] | Recipient address and message content. |
| MaxMind (local database) | GeoIP | Local — no data sent | Country lookup runs locally; listed for transparency. |
Responsible Vulnerability Disclosure (security.txt)
HashEntry implements RFC 9116 for security researcher disclosure. Security findings can be reported directly to our security engineering team.
Strengthen Your Compliance Evidence Today
Start with the free plan. No credit card required.