Security is at the core of the access control and IoT solutions IDE Smart builds. This page describes the measures we take on the idesmart.com website (the "Site") and how to reach us if you find a security vulnerability.
1. Measures on the Site
- Encrypted connection: The Site is only served over HTTPS (TLS); all traffic between your browser and the Site is encrypted.
- Data minimisation: The Site has no accounts, passwords or payment details. The contact form only asks for the information needed to answer your request.
- Input validation: Every field submitted through the contact form is validated on the server for type and length; invalid requests are rejected.
- Abuse protection: The contact form limits the number of submissions from the same source within a short time (rate limiting).
- Safe email content: Information from the form is processed so that no malicious code can run before it is placed in the emails sent to you and to our team. In the automated receipt confirmation sent to you, your email address and phone number are masked.
- Access control: The database holding form submissions is not exposed to the internet; access is limited to authorised staff.
- No advertising or tracking: The Site contains no third-party tracking code for advertising or analytics. Details: Cookie Policy.
2. Beware of fraudulent messages
IDE Smart never asks for passwords, verification codes or payment details by email, phone or message. If you receive a suspicious message asking for such information or requesting a payment on behalf of IDE Smart, do not click any links and report it to support [at] idesmart.com.
3. Reporting a vulnerability (responsible disclosure)
If you believe you have found a security vulnerability in the Site or in an IDE Smart product, we welcome your report. We work constructively with researchers who report in good faith and follow the rules below.
3.1 How to report
Email support [at] idesmart.com with "[Security]" in the subject line. Where possible, include:
- the affected address, product or version,
- the type of vulnerability and its potential impact,
- steps to reproduce it (proof of concept or screenshots, if available),
- how we can contact you.
You can write to us in Turkish or English.
3.2 Our commitments
- We will acknowledge your report within 3 business days.
- We will assess the vulnerability, prioritise the steps needed to fix it if confirmed, and keep you informed.
- We will not take legal action against research carried out in good faith and in line with the rules on this page.
- If you wish, we will credit you by name once the issue is fixed.
3.3 What we ask of you
- Do not disclose the vulnerability publicly or to third parties before giving us a reasonable time to fix it (usually 90 days).
- Do only what is necessary to demonstrate the vulnerability. Do not access, modify, delete or retain other people's data; if you access such data by accident, stop and tell us.
- Avoid tests that disrupt the service.
3.4 Out of scope
- Denial-of-service (DoS/DDoS) or load testing,
- Social engineering, phishing and physical attacks,
- Flooding the contact form with unsolicited messages,
- Unverified output of automated scanners,
- Findings without a practical attack scenario (e.g. a visible version string alone, missing headers on pages without sensitive actions).
4. Machine-readable contact
Our security contact details are also published in line with RFC 9116 at /.well-known/security.txt.
5. Contact
Security reports and questions: support [at] idesmart.com