Our Security Approach
In OW partnerships, decisions are preserved in a traceable and auditable manner across data, model, and application layers with GTFS data security and cloud-based transit analytics safety controls.
Security Foundations
End-to-End Encryption
AES-256 encryption for data at rest and TLS 1.3 for data in transit
KVKK/GDPR Compliant
Full compliance with Turkish KVKK and EU GDPR regulations
ISO 27001 Certified
Internationally recognized information security management
Audit Logging
Comprehensive audit trails for all system operations and access
Access Control
Role-based access control (RBAC) with multi-factor authentication
Secure Infrastructure
Enterprise-grade infrastructure with regular security audits
Compliance & Certifications
Meeting the highest standards for data protection and security
ISO 27001 alignment
Our information security management system (ISMS) is structured around ISO/IEC 27001 principles: leadership commitment, risk-based thinking, and continual improvement. We maintain documented policies and procedures covering asset inventory, risk assessment and treatment, human-resource security, access control, cryptography, operational security, communications, development lifecycle security, supplier relationships, incident management, business continuity, and compliance monitoring.
Security controls are not treated as a static checklist. They are reviewed on a defined cadence, tested against realistic threat scenarios, and updated when our services, partners, or regulatory context change. For enterprise and public-sector customers, we can explain how our practices map to Annex A control themes and support vendor security questionnaires, RFP annexes, and internal audit programs.
Alignment with ISO 27001 is one of the ways we demonstrate due diligence in procurement, insurance, and supervisory conversations—without substituting legal advice, but showing that security governance is embedded in how OW operates.
GDPR & KVKK compliance
We process personal data only where a valid legal basis exists under the EU General Data Protection Regulation (GDPR) and, for data subjects in Türkiye, the Law on Protection of Personal Data (KVKK). Purposes are defined up front (purpose limitation); data categories are minimized to what is necessary (data minimization); and retention is tied to service delivery, legal obligation, or documented legitimate interest, after which data is securely deleted or irreversibly anonymized where appropriate.
Data Processing Agreements (DPAs) describe roles (controller/processor where applicable), subprocessors, categories of processing, cross-border transfer mechanisms when needed, and technical and organizational measures. Data subjects can exercise rights of access, rectification, erasure, restriction, objection, and data portability through designated channels; we acknowledge and respond within applicable statutory timelines.
Our breach-notification playbook defines internal escalation, evidence preservation, containment, and communication to regulators and affected individuals where the law requires. Training and runbooks help ensure that privacy and security incidents are handled consistently rather than ad hoc, including GTFS data security and cloud-based transit analytics safety scenarios.
Encryption, access control & audit logging
Sensitive information at rest is protected using AES-256 (or equivalent industry-standard algorithms) in environments configured for encryption by default, including managed storage and backups where encryption is supported by the platform. Data in transit is protected with TLS 1.2 or higher and modern cipher suites, reducing exposure on public networks.
Access to production-adjacent systems, administrative consoles, and repositories that could affect customer trust is granted on a least-privilege basis through role-based access control (RBAC). Multi-factor authentication is required for privileged roles where the underlying identity provider supports it. Joiners, movers, and leavers are processed through documented workflows so that dormant accounts do not accumulate.
We maintain tamper-evident audit trails for security-relevant events—including sign-ins, permission changes, and privileged operations—with retention suited to investigation and compliance review. Periodic access reviews reconcile entitlements with actual job responsibilities, closing gaps before they become incidents.
Vercel platform security
Our marketing site and related web experiences are deployed on Vercel’s globally distributed edge platform. Traffic benefits from TLS termination at the edge, built-in DDoS mitigation, and continuous platform hardening maintained by Vercel’s security engineering teams. Vercel publishes SOC 2 Type II and related assurance reports for its cloud operations; we inherit a significant portion of physical and network controls through that relationship.
Application builds run in isolated CI environments; secrets are never committed to source control and are injected at build and runtime via protected environment variables. Preview and production projects are separated to reduce the risk of experimental changes affecting live users.
This model trades self-managed server sprawl for a smaller, well-documented attack surface—while preserving fast, cache-friendly delivery worldwide. We complement platform controls with our own secure development practices, dependency awareness, and monitoring appropriate to a public-facing corporate presence.