Your cost data is your shop's most valuable data. Here's how it's protected.
Your pricing rules, customer list and costs never mix with any other company's. We spell out how they're protected, and we don't claim certifications we don't have.
- Hosting
- Germany (EU), Hetzner
- Connection
- HTTPS (TLS)
- Passwords
- Hashed with Argon2
Company isolation
Every record belongs to one company, and every query returns only the records of the company you're signed in to. The company ID never comes from the browser; it comes from your session. An attempt to open another company's record gets a 'not found' response, so you can't even tell the record exists.
Who sees costs
Cost, profit and margin fields are never sent from the server to users without permission; hiding them on screen isn't considered enough. Operators don't see prices, and whether salespeople see costs is your call.
Audit log
Price changes, discount approvals, role changes, deletions and settings changes are logged with who did what, and when.
Encrypted connections and secure sessions
All traffic goes over HTTPS. Passwords are stored as Argon2 hashes, never in plain text. Browser scripts can't read the session cookie (HttpOnly). Sign-in and public forms are rate-limited.
Customer links
Quote links are built on unguessable 128-bit keys and open only the fields of that quote meant for the customer. Cost and margin never appear on that page.
Backups
The database is backed up regularly, and the backups also stay on servers within the EU.
Where your data lives
The app and database run in Hetzner data centers in Germany. For AI message parsing, text is sent to the AI provider for that request only and is not used to train models. The list of service providers is in the privacy policy.
Export and account deletion
Your data is yours: you can export your records. When you close your account, your data is deleted, except where the law requires us to keep it.
KVKK and GDPR
When you enter your customers' personal data into Teklif Atölyesi, you are the data controller and we are the data processor: we process the data only to provide the service, never sell it and never use it for advertising. We'll sign a data processing agreement on request.
Certifications
We don't have ISO 27001 or SOC 2 certification yet. When we do, it will say so here; until then, we explain exactly what we do.
Found a vulnerability?
We take security reports at merhaba@teklifatolyesi.com. Share the details and we'll look into it quickly and let you know what we found.