Last updated · 2026-07-01
Draft — under legal review
This document is a draft pending review by legal counsel. It is published so you can read our current position, but it is not final and may change. Non-English versions are convenience translations; the English text is the reference version.
Our customers run real operations on Clavix360°. This page summarises how we approach security and reliability, at a level that is informative without exposing implementation specifics.
Customer data is encrypted in transit and at rest. Each customer works in a secure, isolated workspace: every record is bound to your company, and that separation is enforced server-side on every request, so one customer's data is never reachable from another customer's account. Access to production systems is role-based and limited to staff who need it, with audit logging.
Strong authentication is enforced for staff access to production systems. Customer admin / manager / salesperson roles inside the product enforce least-privilege access for end users. Administrative actions are logged.
Customer environments are backed up automatically on a regular schedule. We monitor uptime continuously and design for high availability across the components we operate. Where third-party services we depend on experience an outage, we work to mitigate impact and notify affected customers.
We process customer business data solely to operate the service. We do not sell customer data. Sub-processors are bound by contractual data-protection terms. See our Privacy Information for the full picture.
Operations are governed by Turkish data protection law (KVKK, Law No. 6698). For customers and end-users in the EU and UK we recognise GDPR-style rights and provide mechanisms to exercise them — see Your Privacy Choices. We do not currently claim third-party certifications on this page; please contact us if you need additional assurances for procurement.
If a security incident occurs, our process is to contain, investigate, communicate with affected customers without undue delay, and remediate. We may notify regulators where required by law.
Security researchers — please see our Responsible Disclosure page for how to report a vulnerability. We treat reports confidentially and work in good faith with the reporter.
Security or trust questions: hello@clavix360.app — Istanbul, Türkiye.
Questions about this document
This document is provided for general information and may be updated as our service evolves. It is not legal advice. Governing law: Republic of Türkiye.
