Only what exists in the code today; we also list what is missing.
Measures in place
Organizations are isolated
Every query runs within one organization.
Every query runs within the scope of an organization the signed-in user belongs to; the organization id comes from the server-side session, not from the client. If you try to reach an organization you are not a member of, we do not even reveal whether it exists.
Role and permission matrix
Seven roles; permissions are checked on the server.
Seven roles (owner, administrator, project manager, form editor, case worker, analyst, viewer) and their permissions are defined in one place. Permission checks run on the server, not in the interface; unauthorized actions are rejected.
Audit log
Important actions are logged with who and when.
Important actions on organizations, memberships, forms, feedback, applications, projects and indicators are recorded with who did them and when. Only authorized roles can see the records; content such as answer text and note bodies is not written to the log.
Passwords are stored hashed
Passwords are hashed with scrypt.
Authentication uses Better Auth; passwords are not stored as plain text but hashed with scrypt.
Application tracking is protected
Tracking keys are hashed; failed attempts are limited.
Applicants check their status with a reference number and a secret tracking key. The key is stored only as a hash (SHA-256) and compared in constant time. Wrong attempts are limited: after 5 failures for one reference number or 20 for one IP address within 15 minutes, further attempts are blocked.
Browser security headers
Core browser security headers are on.
All responses send X-Content-Type-Options, Referrer-Policy, X-Frame-Options (pages cannot be framed on other sites) and Permissions-Policy headers. The dashboard, sign-in and tracking pages are closed to search engines.
HTTPS enforced (HSTS)
Browsers connect to the site over HTTPS only.
The site is served over HTTPS with the HSTS header on; after one visit the browser will not fall back to HTTP.
Not there yet
No Content Security Policy (CSP)
To be added in the pre-launch test round.
A CSP added without testing can silently break the application, so it will be added during the pre-launch test round.
No two-factor authentication
Sign-in uses only an email and a password.
Sign-in uses only an email and a password.
No certification, compliance attestation or penetration test
No independent audit or certification yet.
No independent security audit or certification process has been completed; when we have one, we will list it here with its documents.
Hosting in Türkiye is a design goal
A design goal, not a commitment today.
The product is designed to be hosted on a server in Türkiye; since we are not live yet, this is not a commitment that applies today.
Personal data
The organization that collects data is the data controller.
Legal responsibility for personal data rests with the organization acting as data controller. Dezy Flow keeps the data an organization collects only inside that organization's account and does not show it to other organizations.
Reporting a vulnerability
Found a vulnerability? Write to us.
If you found a vulnerability, please write to the address below with details; we ask that you tell us before disclosing it publicly.