# [](#security--overview)Security — Overview

This page is a one-stop summary of Maya's security posture. Every claim here is expanded in a dedicated page. Every dedicated page is referenced here.

## [](#summary)Summary

Area

Position

Data scope

Maya ingests **only** verified LLM bot traffic and the public URLs it touched. Filtering happens **inside the brand's perimeter** before transmission.

PII

None. No customer identifiers, cookies, sessions, device IDs, or ad IDs are transmitted. IP addresses are hashed or stripped at source.

Encryption

TLS 1.3 in transit. AES-256 at rest. Per-tenant data isolation.

Hosting

**Türkiye-only.** Maya is a Turkish company; tenant data is processed and stored on servers in Türkiye. No cross-border transfer.

Sub-processors

Listed in the DPA. Minimal set. No data sharing with model providers beyond zero-retention enterprise endpoints used for prompt simulation.

Penetration testing

Annual third-party. Executive summary available under NDA.

Compliance

KVKK-aligned. GDPR-aligned. ISO 27001 program in flight.

Incident response

Defined SLA for notification (≤72h material incident, ≤24h confirmed breach).

Customer controls

Data export, account deletion, source-side filter customization, per-account email notification controls.

## [](#reference)Reference

*   [Data Flow](./data-flow.md)
*   [Data Minimization](./data-minimization.md)
*   [What Maya Does Not Collect](./what-maya-does-not-collect.md)
*   [PII Handling](./pii-handling.md)
*   [Encryption](./encryption.md)
*   [Compliance](./compliance.md)
*   [Data Processing Agreement](./dpa.md)
*   [Incident Response](./incident-response.md)

[PreviousConcepts](/docs/getting-started/concepts)[Next Data Flow](/docs/security/data-flow)