Trust & Security

This page explains how we protect your data on the validrelay platform (the website, the web application and the ERP agent installed on your server). It describes how the platform works today. For vendor security questionnaires and detailed questions, contact us at info@subiq.com.tr.

1. Data controller and KVKK

The data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) is:

SUB IQ YAZILIM ÇÖZÜMLERİ TİCARET LİMİTED ŞİRKETİ
Address: SİLAHTARAĞA MAH. ÜNİVERSİTE 1. SK. NO:13/1 İÇ KAPI NO : Z16 ÇORLU TEKİRDAĞ
Central Registration System (MERSIS) No: 0781108676200001
Registered e-mail (KEP): subiqyazilim@hs06.kep.tr
E-mail: info@subiq.com.tr
Phone: 444 85 39

• The purposes for which personal data is processed, to whom it is transferred and how long it is kept are explained in our Privacy Policy; cookies in our Cookie Policy; demo and webinar forms in the Privacy Notice for Request Forms.
• You can send requests regarding your rights under KVKK Art. 11 to the e-mail or KEP address above.
• From within the application you can start an e-mail-verified request to permanently delete your operational data or to close your account.

2. Data location

For information on the location of the data centre hosting platform data and on our hosting provider, contact us at info@subiq.com.tr.

Some of our service providers may have servers outside Türkiye; in that case personal data is transferred abroad only in accordance with KVKK Art. 9 (see our Privacy Policy).

3. Encryption

3.1 In transit

• Connections from your browser and from the agent to the platform are encrypted with TLS (HTTPS). In production the platform API redirects unencrypted HTTP requests to HTTPS and sends an HSTS header to browsers.
• The agent’s connection to the SQL Server database on your network is opened TLS-encrypted (Encrypt=true) unless the connection settings say otherwise. So that it works with self-signed certificates on internal servers, the server certificate is not validated by default (TrustServerCertificate=true). We recommend setting TrustServerCertificate=false in the connection string and using a trusted certificate on your SQL Server, so that the agent only connects to a verified server.

3.2 At rest (field-level encryption)

The following secrets are stored in the database encrypted with AES-256-GCM. The encryption key is not kept in the database but in the application’s environment configuration:

• the UTS access token and UTS company (actor) code,
• EUDAMED service tokens,
• ERP connection details: database connection string and REST API authorisation token,
• agent connection keys and the copy of the agent token,
• integration authorisation tokens and the e-mail (SMTP) server password.

• User passwords are hashed one-way with BCrypt (work factor 12); they are never stored in plain text.
• Session refresh tokens, password reset links and account deletion confirmation links are stored only as SHA-256 hashes.

4. The ERP agent: where your data is read and what reaches the platform

• The agent is installed on your own Windows server and reads your ERP data inside your network (via a SQL Server connection or your ERP’s REST API). The platform never connects to your ERP directly, and you do not need to open any inbound port on your network. The agent only makes outgoing HTTPS requests to the platform API: to report that it is running, to fetch its configuration and to send data.
• Connection settings (connection string or REST token, SQL query, field mapping) are managed on the platform; the connection string and token are stored encrypted, and the agent fetches them while running. When SQL queries are saved, only a single read-only SELECT statement is accepted.
• What is sent to the platform is the rows returned by the query or endpoint you configure (in batches of 500 rows) plus a 10-row sample shown on the field-mapping screen. The platform turns these rows into product, movement and customer records according to your mapping. You decide which columns are sent through your query; we recommend selecting only the fields needed for UTS/EUDAMED registrations and notifications.
• The agent authenticates with an agent token. The platform verifies the token by its SHA-256 hash; an encrypted copy is kept only so that your authorised users can display it again in the panel. You can renew the token at any time (the old one stops working), and the token of a deleted or suspended connection is no longer accepted. On your server the token is kept in a file encrypted with Windows DPAPI.
• Optional IP restriction: you can limit an agent connection so that its requests are accepted only from the IP addresses or network ranges (CIDR) you specify.

5. Access control

• Multi-tenant architecture: each company’s data is kept separate. Queries on product, movement, customer, submission, agent and permission records are automatically limited to the signed-in company by a tenant filter in the data access layer. For other company records such as users, modules and payments, the same limit is applied in the query of the operation concerned.
• Role- and permission-based access (RBAC): team members are granted view, create, edit, delete and submit permissions separately for UTS, EUDAMED, movement types, packaging and agent settings. A team has at most 5 users; only the company administrator can invite members and change permissions.
• Session cookies are set as HttpOnly, Secure and SameSite=Lax; scripts on the page cannot read them.

6. Audit logs

• Field changes that users make to product and customer records on screen or through Excel imports, and the deletion of these records, are written to a revision history (who, when, what changed). For movements, deletions and splits are recorded with who did them and when. Edits to movement fields and automatic updates made by the ERP agent or the UTS product sync are not written to this history. In day-to-day use records are not physically deleted but marked as deleted.
• What is recorded for submissions: for direct EUDAMED submissions, the XML sent and the response received from EUDAMED; for UTS product registrations, the response from UTS; for UTS movement notifications (production, sales, etc.), the notification status together with the UTS notification number or the error message.
• Overriding validation rules is recorded together with who did it, when and why.
• Changes to system settings (e.g. e-mail and website settings) are recorded with the user, time, IP address and old/new value; secret values are masked in the log. Before sensitive settings such as the mail server or site tags change, system administrators are notified by e-mail.

7. Application security

• Every cookie-authenticated write request is checked to come from an allowed origin (CSRF protection).
• Rate limiting: at most 100 requests per minute per IP address and endpoint; 10 per minute for sign-in, sign-up and password operations. Public forms and free tools have additional limits; these limits use a keyed hash (HMAC-SHA256) of the IP address, not the address itself.
• Files you upload to the free EUDAMED XML validator are not written to disk, to the database or to logs.
• A Content Security Policy (CSP) is applied in reporting mode in the browser; we receive a violation report when an unexpected script or connection is detected.

8. Backups

Backups of the platform database are taken. For information on backup frequency, retention and restore procedures, contact us at info@subiq.com.tr.

9. Personal data breach notification

If we learn that personal data we process has been obtained by others unlawfully, we notify the Personal Data Protection Board and the data subjects as soon as possible, as required by KVKK Art. 12(5). In line with the Board’s decision No. 2019/10 of 24 January 2019, the Board is notified without delay and at the latest within 72 hours of our becoming aware of the breach, and affected individuals are notified within the shortest reasonable time after they have been identified. If a breach affects your data on the platform, we also inform your company administrator without delay.

10. Sub-processors (service providers)

External service providers used by the platform and when they are involved:

Contact us for information on our hosting (infrastructure) provider. UTS (Turkish Medicines and Medical Devices Agency) and EUDAMED (European Commission) are not sub-processors: your data reaches these public systems only through registrations and notifications that you start or enable.

11. Reporting a vulnerability and contact

If you notice a security vulnerability or have a security question, please write to info@subiq.com.tr. We will review your report and get back to you.