Information Security Policy

Effective Date: September 17, 2026

At WAGONN Bilgi Teknolojileri ve Danışmanlık Limited Şirketi (“WAGONN”), we recognize information security as an indispensable pillar of operational excellence and business continuity across our enterprise software development, system integration, cloud ecosystem orchestration, and strategic IT consultancy services.

Our company commits to safeguarding the confidentiality, integrity, and availability of all institutional information assets, client datasets, business partner records, and employee data in accordance with international standards.

1. Core Principles (The Information Security Triad)

Aligned with the ISO/IEC 27001 standard framework, the WAGONN Information Security Management System is built upon three core tenets:

• Confidentiality: Restricting access to proprietary information, source code, client repositories, and systems exclusively to authorized personnel.
• Integrity: Safeguarding information assets and software codebases against unauthorized, accidental, or malicious alteration, corruption, or deletion, ensuring verifiable accuracy.
• Availability: Ensuring authorized stakeholders have resilient, uninterrupted access to critical business operations, cloud infrastructures, and enterprise software solutions whenever required.

2. Security Commitments and Operational Scope

WAGONN Executive Leadership and operational teams strictly adhere to the following directives:

• Regulatory Compliance & Standards: Maintaining full alignment with applicable international and local frameworks, including ISO/IEC 27001, Turkish Personal Data Protection Law No. 6698 (KVKK), and Law No. 5651 governing internet environments.
• Secure Software Development (DevSecOps): Implementing secure coding guidelines (OWASP Top 10 standards) across all design, development, and deployment stages of enterprise software modules (e.g., Thalamus ERP, Synapse) and executing routine third-party penetration tests.
• Proactive Risk Management: Continually identifying, assessing, and mitigating risks to corporate and client information assets down to acceptable risk appetites through targeted technical and administrative controls.
• Infrastructure Security & Data Isolation: Enforcing tenant isolation, robust cryptographic protocols (TLS/AES), perimeter web application firewalls (WAF), role-based access control (RBAC), and mandatory Multi-Factor Authentication (MFA) across production environments.
• Business Continuity & Disaster Recovery: Running automated backups, scheduled failover mechanisms, and periodic disaster recovery drills to guarantee operational resilience against technical incidents, hardware failures, or cyberattacks.
• Incident Response Management: Operating a dedicated security incident workflow to detect, isolate, conduct root-cause analyses on, and report security breaches and vulnerabilities to competent authorities and affected parties within regulatory timelines.
• Personnel Awareness & Culture: Fostering a continuous security culture through recurring training programs on cybersecurity, social engineering awareness, and secure data handling, supported by binding confidentiality agreements (NDAs) for all employees and contractors.

3. Continuous Improvement and Governance

WAGONN evaluates the maturity and effectiveness of its Information Security Management System via periodic internal audits, independent external assessments, and management review meetings, continually enhancing infrastructure safeguards against evolving threat landscapes.

For security disclosures, audits, or inquiries regarding our information security practices, please contact:

• Entity: WAGONN BİLGİ TEKNOLOJİLERİ VE DANIŞMANLIK LİMİTED ŞİRKETİ
• Address: Esentepe Mh. Büyükdere Cd. No: 199/6 Levent 199 Kat: -1 Levent, Şişli, İstanbul, 34330, Türkiye
• Email: [email protected] / [email protected]
• Phone: +90 850 532 7379