ISO 27001 Information Security Policy

1. Our Fundamental Principles (CIA Triad)

EGuardAgent has built its information security processes on three fundamental principles:

Confidentiality

Ensuring that only authorized personnel can access customer data. (Example: 2FA, Role-based authorization)

Integrity

Preventing unauthorized modification or deletion of data. (Example: Log hashing, Code signing)

Availability

Guaranteeing that authorized users can access data whenever needed. (Example: Offline operating mode, Redundant server architecture)

2. Our Technical Security Controls

The specific technical controls we implement in accordance with ISO 27001 standards and their counterparts in the EGuardAgent architecture are as follows:

A. Access Control

A multi-layered security architecture is implemented to prevent unauthorized access:

• Two-Factor Authentication (2FA): When accessing the management panel, in addition to the standard password, HMAC-SHA256 TOTP algorithm-based, 6-digit one-time passwords valid for 5 minutes are mandatory.
• Secure Session Management: All API requests are validated with JWT (JSON Web Token) tokens valid for 60 minutes; expired sessions are automatically terminated.
• License Validation Middleware: The validity and status of the license are verified server-side on every API request.
• Protected Removal: The desktop agent can only be removed with authorized admin credentials; verification is performed through the UninstallForm during this process.

B. Cryptography

Data is encrypted using industry-standard algorithms both during transmission (data-in-transit) and at rest (data-at-rest):

• Database Encryption: Local data stored at endpoints (Logs, settings) are stored in encrypted SQLite databases using SQLCipher (256-bit AES) technology. Even if the database file is compromised, the data cannot be read.
• Password Security: User passwords are never stored in plaintext in the database; they are hashed using the BCrypt (Work Factor 11) algorithm.
• Communication Security: All data traffic between client and server is encrypted using HTTPS/TLS 1.2+ protocol.

C. Operations Security and Logging

Comprehensive logging mechanisms are implemented for traceability and security of system activities:

• Detailed Audit Logs: All administrator activities on the system (policy changes, user additions/deletions) are recorded.
• Error and Debug Logs: System errors, without including personal data, are stored in the %LocalAppData% directory with automatic cleanup (7 days) policy.
• Malware Protection: To protect its own integrity, EGuardAgent detects and prevents interference with system files (Task Manager, Registry Editor, etc.).

D. Communications Security

Measures taken to ensure network security:

• Secure Synchronization: Services like "BulkLogSyncService" transmit data in packets with validation keys to ensure data integrity during data transfer.
• Minimum Data Principle: Only necessary log data (Base64-encoded screenshots, text logs) are sent to the server; unnecessary network traffic is avoided.

E. Business Continuity Management

Resilience against service disruptions:

• Offline Mode: If internet connectivity is lost, EGuardAgent does not stop; the local policy engine continues to operate and accumulates logs in an encrypted local database (Queue). Automatic synchronization is activated when connectivity is restored.
• Automatic Updates: The software's currency and security are ensured through silent background updates (Inno Setup /VERYSILENT) that require no user intervention.

3. Risk Management and Breach Notification

Our company regularly evaluates information security risks and takes proactive measures against potential threats (DDoS, Brute-Force, data leaks).

In the event of a possible security breach or vulnerability discovery;

• The breach is detected and addressed immediately.
• Affected customers and (where applicable) legal authorities (KVKK, USOM) are informed within legal timeframes.
• Root cause analysis is performed and patches are released to prevent recurrence.

4. Commitment

As EGuardAgent Management, we commit to providing all necessary resources for the establishment, implementation, operation, monitoring, review, maintenance, and continuous improvement of the Information Security Management System (ISMS). The security of our customers' data is the most critical part of our business.