About certifications
talep.io does not yet hold SOC 2 or ISO 27001 certification; an independent audit is on our roadmap. Supabase and Vercel, the infrastructure providers that hold your data, have SOC 2 Type II reports. We process personal data under KVKK and GDPR; details are in our Privacy Policy.
Controls
Encryption
The database and uploaded files are encrypted on disk with AES-256.
All traffic between your browser, our servers and our providers is encrypted with TLS.
Supplier bank details (IBAN, bank name, SWIFT) and request and tender messages are encrypted again by the application with AES-256-GCM before they are written to the database. They are never stored as plain text.
The usernames and passwords you give us to connect to your ERP are encrypted with a key separate from the one used for messages.
Encryption keys live in the application server's secret configuration, not in the database. Someone holding a copy of the database cannot decrypt these fields.
Access and identity
Every record belongs to one company and access rules are enforced in the database itself (row level security, RLS). Even if the interface had a bug, another company's data would not come back from a query.
Admin, member and requester roles are separate within a company. For example, requesters do not see tender screens.
Users can add a second step to their account with an authenticator app. Once added, it is required both in the app and in the API.
Sign-in, sign-up, password reset and supplier sign-in links are protected against automated attacks with Cloudflare Turnstile.
A user arriving from a reset link cannot enter the app before setting a new password.
Suppliers sign in through a separate portal and only see the tenders they were invited to and their own bids.
Tender security
In a sealed-bid tender, bid amounts, line items and bid documents are shown to no one at the buying company, admins included, until the envelope is opened. The rule is enforced in the database and document download links are closed too.
In a sealed-bid tender, the bid amount, line item prices and commercial terms are encrypted by the application with AES-256-GCM the moment the supplier submits the bid, and stored that way. Until the envelope is opened they are not readable in the database. When it opens they are decrypted and stored normally so comparisons and reports work.
A supplier cannot access another supplier's bid, documents or messages.
Who did what and when during a tender is kept in an audit log. Users cannot write to or delete entries in this log.
Application and operations
Cross-company access rules are verified by automated tests that run against the live database.
Error tracking runs on servers in the EU. Before an error report is sent, user identity, session cookies, authorization headers and URL parameters are removed.
If you believe you have found a vulnerability, write to security@talep.io. We review every report and get back to you.
Data and privacy
AI features run on Anthropic's commercial API. Anthropic's commercial terms prohibit training models on customer content. When you use an AI feature, only the content needed for that task is sent.
Account data is deleted 30 days after the account is closed and technical logs after 90 days. Request, approval and invoice records are kept for 10 years as required by law.
Your data is never shared with third parties for advertising or marketing, and never sold.
Visit statistics are collected only on marketing pages and only with your consent. No analytics cookies are used inside the app or the supplier portal.
What talep.io staff can see
This is the question enterprise buyers ask most. The short answer: our internal tools do not show customer content.
Our own admin panel never queries bid amounts, messages, bank details, requests, contracts or documents. It shows only account information such as company name and user count, and the support tickets you send us. An automated test guards this rule: if the panel's code ever reaches customer content, the test fails and the change cannot ship.
talep.io has no feature that lets staff sign in to a customer account on the customer's behalf.
The internal panel does not open for a session that has not completed two-step verification.
As the operator of the service we have technical access to the database. We use it only for maintenance and incident response. Bank details, messages and unopened sealed bids are encrypted separately, so they are not readable in the database. The encryption key lives on the application server, so looking at the database alone is not enough, but someone with access to both the server and the database could decrypt these fields.
Subprocessors
Providers that process part of your data so we can deliver the service. We do not share customer data with any company not on this list.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
Supabase | Database, file storage, authentication | All account and transaction data | EU (Frankfurt, Germany) |
Vercel | Application hosting and server processing | Data processed during a request | EU (Frankfurt) and global network |
Resend | Transactional email (invites, notifications, password reset) | Name, email address, email content | US |
Anthropic When the feature is used | AI features | Only the content the feature in use requires | US |
Sentry | Error tracking | Technical details at the time of an error (user identity and cookies removed) | EU (Germany) |
Cloudflare | Bot protection (Turnstile) | IP address and browser signals | Global network |
Google Marketing pages only, with consent | Visit statistics (Google Analytics) | Page visits, browser and device information | US |
Data processing agreements are in place with these providers.
Documents
You can send your company's security or vendor assessment questionnaire to info@talep.io. We answer it using the information on this page and, where needed, with our technical team.
Updates
We announce a new subprocessor in this section at least 10 days before we start working with it, and notify company admins by email. You can send an objection to info@talep.io within that period.
Sealed-bid amounts, line item prices and commercial terms are now stored encrypted until the envelope is opened. This item moved from the roadmap into the controls.
Trust Center published. Sentry (error tracking) and Cloudflare (bot protection) added to the subprocessor list. Both services were already in use and missing from the list.
Roadmap
Work we have not done yet but plan to. Each item moves into the controls above when it is complete and is announced under Updates.
Writing every action taken in the internal panel, with who did it and when, to a tamper-proof log.
A standard data processing agreement to sign with enterprise customers.
Having the application tested by an outside security firm and sharing a summary report.
Having our information security management certified by an independent auditor.
Contact
© 2026 Talep Teknoloji A.Ş. All rights reserved.