Information Security Policy

1. Purpose

To explain the rules we follow and the technical measures we take today to protect the confidentiality, integrity and availability of personal and organisational information processed at hangel. This is the public policy; our internal information security management system documents, prepared on the basis of ISO/IEC 27001 (ISMS-01 top-level policy, ISMS-02 scope, ISMS-03 risk method), are drafts and will be completed so that they do not contradict this policy.

2. Scope

The hangel.org website and subdomains, the hangel iOS and Android apps, the Oda meeting service, the Google Cloud/Firebase infrastructure behind them, the source code repository and everyone with access to these systems (management, employees, volunteers, external developers, suppliers).

3. Principles

1. Least privilege. Everyone accesses only the data needed for their role.
2. Health data gets the highest protection. Data such as blood group and health consent is protected by separate rules.
3. Risk-based measures. Measures are chosen according to risk; life-critical flows (emergency blood requests, sign-in) come first.
4. Shared responsibility. Physical data-centre security lies with the cloud provider; access, configuration, code, backups and incident management lie with us. Google's certifications do not transfer to hangel.
5. Honesty. We do not present a security certificate or audit we do not have.

4. Roles and responsibilities

• Board of Directors: approves this policy and allocates resources.
• Technical lead: responsible for access, configuration, backups and secure development.
• Super-admins: use only the panel sections opened to them and never share their accounts.
• Everyone: reports any suspicious situation immediately.

5. How it works at hangel today

• Encrypted connections: All connections use HTTPS and the HSTS header is sent. Google Cloud encrypts stored data by default.
• Access rules: Access to the database and file storage is limited by security rules enforced on the server, and these rules have automated tests. Sensitive fields such as organisations' bank details are kept in separate, restricted records. AI provider keys are stored in records that only the server can read and are never shown in full on any screen.
• Sign-in: Firebase Authentication is used; passwords are not stored in our database. Passkeys and optional two-step verification (app notification or e-mail code) are available.
• Browser security: Security headers and the core rules of the Content Security Policy (CSP) are enforced.
• Abuse prevention: Google reCAPTCHA and additional bot checks protect the registration, contact and survey forms; rate limits apply to endpoints such as reports, data requests and certificate verification.
• Logging and monitoring: A large share of server-side actions that change data are written to an audit log (kept for two years). Errors are monitored with Sentry in a European (Germany) data region; error reports do not include names, e-mail addresses or user IDs.
• Backups: The database is backed up automatically every day and backups are kept for 98 days.
• Software components: A list of the open-source components used by the web app (SBOM, CycloneDX) is generated and published with every release.
• Vulnerability reports: Security vulnerabilities can be reported to info@hangel.org; receipt is acknowledged within 3 business days at the latest (hangel.org/guvenlik).

6. Not yet in place and our goals

• We do not hold an ISO/IEC 27001 certificate, a SOC 2 report or an independent security audit.
• We have not commissioned an independent penetration test; security reviews so far were carried out by our own team.
• The full version of the CSP that restricts script sources is still in report-only mode.
• Multi-factor authentication is not mandatory for all privileged accounts; our target is 100%.
• Not all secrets have been moved to Secret Manager yet; our target is zero secrets in plain text.
• A documented restore-from-backup test has not yet been carried out; point-in-time recovery (PITR) is switched off.
• Regular (quarterly) access reviews and information security awareness training have not started yet.
• We do not pay bounties for vulnerability reports.

7. How to raise a concern

• Security vulnerability: info@hangel.org (subject "Security report").
• Suspected personal data breach: kvkk@hangel.org (Data Breach Response Policy).

8. Review

At least once a year; after a significant incident, a new cloud region, a change of legal entity or a major architectural change.

9. Related documents

hangel.org/guvenlik · Data Breach Response Policy · Crisis and Business Continuity Policy · Risk Management Policy · Supplier and Third-Party Policy · Existing "Information Security Policy" and "ISO 27001 Status and Roadmap Statement"