Platform · Security
Every report is cryptographically sealed the moment it is produced; change one byte and an independent verifier sees it.
Ed25519 · SHA-256 · HSM · KVKK compliant
Security Profile
sec-profile · v2026.04
Four supports
Cryptography, identity, data and audit — none of them is enough alone. Together the four make up OtoTasdik's trust model.
01 · Cryptography
Ed25519
Every time a report is finalised, the private key signs it inside the HSM.
SHA-256 chain
r(n).hash = SHA-256(r(n-1).hash ∥ r(n).body). Change one byte and the chain breaks.
Merkle root
The daily Merkle root is timestamped against an independent calendar server.
No re-signing
A revision does not erase the old signature; it appends the new one to the chain.
02 · Identity & Access
RBAC
System (6) + centre (3) + technician (2) + individual (2) roles. Permissions are checked at build time.
Tenant isolation
Every query is filtered to the centre/branch scope. Cross-tenant reads are blocked by test.
Session
PASETO v4, 15-minute access + 14-day refresh. Revocable server-side.
MFA
Mandatory TOTP or WebAuthn for management and finance roles.
03 · Data Lifecycle
Data residency
Primary region eu-central-1 (Frankfurt); the standby copy is encrypted in the TR region.
At rest
AES-256-GCM. Keys are wrapped with KMS and rotated every 90 days.
In transit
TLS 1.3 with HSTS preload and HTTP/2.
Retention
Role-based retention periods under KVKK; automatic deletion jobs run weekly.
04 · Audit & Traceability
Audit log
Append-only, kept for 10 years. Who changed what, and when — in a single table.
Immutable evidence
For each report: photographs + VIN + technician + signature + hash → one evidence bundle.
Alerts
Abnormal read volume, failed signing and cross-tenant attempts raise an immediate alert.
Responsible disclosure
security.txt + bug bounty · coordinated release.
The life of a report
The technician enters findings and photographs into the panel through a structured form. Every field is typed and every photograph is stored with signed metadata.
The form, the list of photo hashes and the metadata are canonicalised (JSON Canonical Form, RFC 8785).
The centre HSM signs the report's evidence bundle with Ed25519. The private key never leaves the HSM.
The report hash is chained to the previous report hash with SHA-256; the daily Merkle root is stamped against an independent calendar server.
The report's QR code carries the verification URL, the report identifier and a signature digest. Opening the URL makes the server verify the signature and the chain.
Compliance & audit
Privacy notice, processing inventory and automatic retention periods under Türkiye's data-protection law.
An Ekspertiz flow compliant with the TSE Service Competence Certificate (Hizmet Yeterlilik Belgesi).
ISMS scope and controls are written up; independent audit in Q3 2026.
The privacy-information extension; to be audited together with 27001.
Application security controls are scanned and reported on a regular schedule.
An independent test each year; a 30-day patch SLA for critical findings.
Responsible disclosure
Under our coordinated-release policy, send the finding straight to our security team. We commit to a reply within 48 hours and a patch within 30 days.