These texts are drafts under legal review. · Version 1.2

Information Security (DRAFT)

Last updated: 13 October 2026 (draft). The Turkish version prevails in case of conflict.

This page describes how Guestkite protects the data of businesses and their guests. It lists only what we actually do today; we do not claim anything we do not do (for example a certification). Found a vulnerability? support@guestkite.com (see s.8).

1. Infrastructure and data location

• Guestkite runs on Cloudflare (Workers, Durable Objects, D1, R2). Data is stored in Cloudflare data centres outside Turkey; the legal basis for this transfer is set out in the Privacy Policy.
• Cloudflare encrypts stored data at rest. Every connection between browser and server is encrypted with HTTPS.
• Each business's data lives in its own storage unit. One business's messages, guests and settings are never kept in the same table as another's.
• The test environment (staging) is fully separate from production: its own database, storage and keys. Production data is never copied to it.

2. Encryption and keys

• Businesses' Telegram bot tokens and integration passwords are stored encrypted with AES-GCM and never shown again in the panel.
• API keys are stored only as a one-way hash (SHA-256); we cannot see the key itself.
• Encryption keys stay server-side in Cloudflare's secret store and are never sent to any app or browser.

3. Sign-in and permissions

• The panel has no passwords. Sign-in uses a one-time code sent to the user's Telegram account; attempts are rate-limited.
• The session cookie cannot be read by page scripts (HttpOnly, SameSite) and expires after 30 days. "Sign out on all other devices" ends every session on the server.
• Roles: owner, admin, staff. Staff cannot see or change settings or invoices. Permissions are checked again on every request.
• Someone who joins with the team link receives no guest messages until an owner or admin approves them.
• Every administrative action by Guestkite staff (suspension, subscription, restore and so on) is written to a log that is never deleted.

4. Message safety

• Every message from the team to a guest is checked before it is sent: abuse, leaks of personal data and spam are stopped.
• The first reply of someone new in a team group waits for the group admin's approval.
• Photos from guests are checked for unsafe content; files are never on a public address, open only through short-lived signed links and are deleted after 30 days.
• Rate limits cap how many requests a guest or an API key can send in a short time.

5. Backups and recovery

• Every night an AES-256-GCM encrypted copy of each business's data is stored separately and kept for 30 days.
• After an error or data corruption, a business can be restored from a backup or taken back to a moment in the last 30 days. Guests who deleted their data after that point stay deleted; a removed team permission does not come back.
• Every new release passes automated tests and a separate test environment first.

6. Deletion and retention

• A guest can delete their own data in the chat with "🔒 Privacy" → "Delete my data".
• The business chooses its retention period (90, 180, 365 or 730 days); older conversations are deleted automatically.
• All data of a closed business is deleted after 30 days, backups included.
• A business can export its data at any time; the export contains no passwords, keys or tokens.

7. AI

• AI models are used for translation, voice messages and the assistant. Messages are never used to train any model (Terms of Service s.6.3).
• The assistant answers only from information the business has approved.

8. Reporting a vulnerability and incident handling

• If you think you have found a vulnerability, write to support@guestkite.com. We confirm receipt within 2 working days. We take no legal action over reports made in good faith.
• In a personal data breach, the Turkish Personal Data Protection Board and the affected businesses are notified within the period set by law (at most 72 hours).

9. Good to know

• Guestkite does not yet hold an information security certification such as ISO 27001.
• Telegram's own infrastructure is not under Guestkite's control; messages to and from Telegram are subject to Telegram's terms.