Security & Incident Response Plan

1. Scope

This plan covers the AgentFabrica application, its servers and the data received from connected accounts (marketplaces, ad and social media platforms). A security incident is any unauthorised access to, change to or deletion of data, or unauthorised use of the service. A suspected incident also starts this plan.

2. Roles

• Incident lead: Hamza Demir (Co-founder & CEO). Declares the incident, runs the response, sends the notifications and writes the closing report.
• Technical response: the incident lead or a team member they assign. Cuts access, preserves evidence, fixes the cause and restores the service.
• Reporting channel: legal@agentfabrica.com. Users and researchers report anything suspicious to this address.

3. Detection

• Web traffic is accepted only from the Cloudflare network; direct requests to the server are dropped at the firewall and management ports are closed to the outside. Repeated failed SSH logins are blocked by fail2ban.
• Server access is by SSH key only; password login is disabled.
• Malware scanning runs with ClamAV, with automatic signature updates.
• The application writes sign-in attempts, password changes and two-step verification failures to an audit log.

4. Response steps

1. Contain: immediately disable the affected account, key or server access.
2. Preserve evidence: keep logs and copies of affected files; do not overwrite them.
3. Assess: which data, which users and which time window were affected, measured and written down.
4. Fix: close the gap; rotate exposed keys and passwords and end active sessions.
5. Recover: bring the service back on a verified clean version and confirm the fix.
6. Report and learn: record the root cause and the fix in the closing report and update this plan if needed.

5. Notification

• Any incident affecting data received from Amazon (Amazon Information) is reported to security@amazon.com within 24 hours of detection. For other marketplaces and platforms, the channel and timeline in that platform's developer terms apply.
• Affected users are told by email what happened and what they should do.
• Personal data breaches are notified to the Turkish Personal Data Protection Authority as required by Law No. 6698 (KVKK).

6. Password and access policy

• Passwords are at least 12 characters and must contain a letter, a digit and a special character.
• Passwords found in known data breaches are rejected.
• Passwords are renewed every 365 days; an expired password cannot sign in and the previous password cannot be reused.
• Accounts can turn on two-step verification (authenticator app code). Changing the password ends all other sessions.
• Connected-account keys are stored encrypted; access is limited to the people whose work requires it.

7. Review

This plan is reviewed every six months and after every security incident. The date on this page shows the last review.