Information Security Policy
Our approach to protecting the confidentiality, integrity and availability of information.
Last updated: October 2026
At VexCore Teknoloji A.Ş., we regard information security as the foundation of the trust our customers and stakeholders place in us and of our business continuity, across the software solutions we build for the public sector, local governments and private enterprises. This policy sets out our information security principles and commitments, in line with the ISO/IEC 27001 Information Security Management System (ISMS) approach.
1. Purpose and Scope
The purpose of this policy is to establish the framework for protecting the confidentiality, integrity and availability of the information used and produced in VexCore's business processes.
Where applicable, this policy covers:
- our employees and managers;
- contracted contributors, business partners and suppliers;
- our information systems and business processes;
- the products and services we develop, including Notivex, and their development processes;
- all of our physical and digital information assets.
2. Core Principles of Information Security
Confidentiality
Information is accessible only to authorized individuals, and only to the extent their role requires.
Integrity
Information is kept accurate and complete, and is safeguarded against unauthorized or uncontrolled modification.
Availability
Authorized users can access the information and systems they need, when they need them.
3. Our Information Security Commitments
We treat security as an integral part of design at every stage of our software development, integration and maintenance activities. Within this framework:
3.1. Identifying and protecting information assets
We identify our physical and digital information assets, assign clear ownership and apply protective measures proportionate to their importance.
3.2. Assessing and managing risk
We identify and assess information security risks and manage them to an acceptable level through a risk-based approach.
3.3. Authorization and access control
Access to information and systems is granted on a least-privilege, need-to-know basis and is reviewed regularly.
3.4. Protecting personal and confidential information
We process and protect personal data and confidential information in line with the Turkish Personal Data Protection Law No. 6698 (KVKK) and other applicable legislation.
3.5. Legal, regulatory and contractual requirements
We monitor and fulfil applicable legal and regulatory obligations, contractual commitments, customer requirements and internal rules.
3.6. Information security incident management
We record and assess information security incidents, investigate their root causes and implement improvements to prevent recurrence.
3.7. Business continuity
We prepare to keep our critical business processes and services running in the event of disruption.
3.8. Supplier and third-party security
We define and monitor information security requirements in our relationships with suppliers and business partners.
3.9. Information security awareness
We continuously strengthen the security awareness of our employees and the parties we work with.
3.10. Continual improvement
We measure, review and continually improve the effectiveness of our information security approach.
4. Management Commitment
Our senior management supports the Information Security Management System approach and ensures that information security roles and responsibilities are defined and that the necessary resources are provided. Management promotes the integration of information security requirements into business processes, a risk-based approach and continual improvement.
5. Employee and Stakeholder Responsibility
Information security is not solely the responsibility of IT or security teams; it is shared across the entire organization. All employees and the parties we work with are expected to comply with this policy and the related internal rules. Non-compliance is addressed in accordance with the applicable contractual provisions.
6. Reporting Information Security Incidents
If you notice a suspicious situation or an event that may affect information security, please report it to us at info@vexcoreteknoloji.com or through our contact page. Reports are handled with due regard for confidentiality.
7. Policy Review
This policy is reviewed periodically and whenever necessary in light of technological developments, organizational changes, information security risks and legal and regulatory developments, and is kept up to date.
For details on how personal data is processed, please see our KVKK Notice and Privacy Policy.