Security
For guest data and Law 5651 logs, we state plainly what we protect and how.
Every item on this page is backed by a control that runs in the product. We also list what we have not done yet.
Controls
Security measures running on the platform today
Not marketing promises: a summary of controls that are implemented.
Encrypted connections (HTTPS)
The panel, the API and the guest login pages hosted by Hotspotly are served over HTTPS only; HSTS tells browsers never to use plain HTTP. The router's own local login redirect depends on the device's settings.
Secrets encrypted in the database
Router passwords, integration keys, 2FA secrets and Turkish ID / passport numbers are stored encrypted with AES-256-GCM in the application database. The keys are kept out of the database and the backups.
Panel passwords are one-way hashed
Panel account passwords are stored as bcrypt hashes; plain-text panel passwords are never kept.
Two-factor authentication
Two-factor authentication with an authenticator app (TOTP) is mandatory by default for administrator, reseller and customer accounts (including team members); only the platform administrator can exempt a business, with a recorded reason. Recovery codes are single-use.
Customer data separation
Every record belongs to one customer; panel endpoints check access by role and customer. A customer cannot see another customer's devices, guests or logs.
Audit log
Logins, failed attempts, password and 2FA changes, session revocations and every view and export of Law 5651 logs are written to the audit log.
Tamper-evident Law 5651 logs
Access logs are sealed every night with SHA-256 digests, a chained manifest and a Merkle tree; any change made after sealing shows up on verification.
Consent and agreement records that cannot be altered
Guest consent records and agreement acceptances are append-only: the application never updates or deletes them; withdrawing consent is written as a new record.
Daily backups and a restore drill script
Databases are backed up automatically every day and the last 14 backups are kept. Restores are designed to be rehearsed regularly with a drill script that never touches the live database and checks the schema, row counts and Law 5651 seals.
Sub-processors
Third parties that process data
Providers we work with to deliver the service. Some are only involved when you enable the related feature.
| Provider | Purpose | Scope |
|---|---|---|
| Hosting provider | Servers, databases and backups. The provider's name and data-centre location will be published here once confirmed. | All customers |
| Cloudflare, Inc. | DNS, TLS termination and attack protection: panel and API traffic passes through this network. | All customers |
| iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) | Subscription and credit payments; card details never reach Hotspotly servers. | All customers |
| TÜBİTAK BİLGEM Kamu SM | RFC 3161 timestamps for the daily Law 5651 seals; starts once the subscription is active. Receives no personal data; only a daily digest value is sent. | Coming soon |
| NetGSM · İleti Merkezi · Mutlucell | Guest SMS verification codes, sent through the SMS provider you choose. | If you enable it |
| Google · Meta (Facebook) | Guest login with a social account; only at venues that enable this method. | If you enable it |
| Mews · Cloudbeds | Room number and surname check for hotel guests; only at hotels with a PMS integration. | If you enable it |
| Meta Platforms (WhatsApp Business) | Verification and notifications over WhatsApp; this channel is not offered yet. | Coming soon |
A data processing agreement (DPA) is available on request. The current list is always published on this page.
Responsible disclosure
Found a vulnerability?
We welcome reports from security researchers. Please email us before disclosing a vulnerability publicly.
- 1.Email the issue, the affected address and the steps to reproduce it.
- 2.We acknowledge your report within 5 business days at the latest.
- 3.We keep you updated while we verify and fix it; we aim to close critical and high findings within 30 days.
- 4.Once the fix is live, we are happy to credit you by name if you wish.
In scope
The website, panel and API on hotspotly.net, the guest login pages (portal) and security.txt.
Out of scope
Denial-of-service attempts, social engineering, physical access, our customers' own network devices and third-party services. Do not access real guest data; if you do, stop and tell us.
Good-faith safe harbour
We will not take legal action over research carried out in good faith within these rules. We do not run a paid bug bounty programme at the moment.
If a data breach happens
We have a written incident response plan. In a personal data breach we inform affected customers without delay and prepare the information needed to notify the Turkish Personal Data Protection Board within 72 hours of becoming aware of the breach, as KVKK requires.
What we do not claim yet
- We do not hold ISO 27001 or a similar certification.
- No independent penetration test has been carried out yet; the scope and readiness documents are ready and an annual external test is planned.
- There is no paid bug bounty programme.