Security — Overview

This page is a one-stop summary of Maya's security posture. Every claim here is expanded in a dedicated page. Every dedicated page is referenced here.

Summary

Area	Position
Data scope	Maya ingests only verified LLM bot traffic and the public URLs it touched. Filtering happens inside the brand's perimeter before transmission.
PII	None. No customer identifiers, cookies, sessions, device IDs, or ad IDs are transmitted. IP addresses are hashed or stripped at source.
Encryption	TLS 1.3 in transit. AES-256 at rest. Per-tenant data isolation.
Hosting	Türkiye-only. Maya is a Turkish company; tenant data is processed and stored on servers in Türkiye. No cross-border transfer.
Sub-processors	Listed in the DPA. Minimal set. No data sharing with model providers beyond zero-retention enterprise endpoints used for prompt simulation.
Penetration testing	Annual third-party. Executive summary available under NDA.
Compliance	KVKK-aligned. GDPR-aligned. ISO 27001 program in flight.
Incident response	Defined SLA for notification (≤72h material incident, ≤24h confirmed breach).
Customer controls	Data export, account deletion, source-side filter customization, per-account email notification controls.

Reference

• Data Flow
• Data Minimization
• What Maya Does Not Collect
• PII Handling
• Encryption
• Compliance
• Data Processing Agreement
• Incident Response