Security at Gurulu
Your data security is foundational to everything we build. Here is how we protect it.
Infrastructure
Hetzner dedicated server in Falkenstein, Germany. ISO 27001 certified data center. All data stays in the EU.
Encryption
TLS 1.3 for all data in transit. AES-256-GCM credential vault for secrets. All backups encrypted at rest.
Authentication
Magic link and Google OAuth sign-in. No passwords stored, ever. Device pairing with explicit approval flow.
Data Isolation
Tenant-scoped queries across all data stores. Row-level security enforced. Zero cross-tenant data leakage by design.
Network
Cloudflare WAF and DDoS protection on all endpoints. Rate limiting at 200 req/s per IP. Bot detection enabled.
Backup
Daily automated PostgreSQL and ClickHouse backups. 7-day retention with RAID1 mirror storage for redundancy.
Monitoring
24/7 uptime monitoring with automated alerting. Disk health, CPU, memory, and service-level checks run continuously.
Access Control
SSH key-only server access. Fail2ban intrusion prevention. No password authentication permitted. Minimal access principle.
Compliance
Fully compliant with GDPR (EU), KVKK (Turkey), and ePrivacy Directive. DPA available upon request.
Responsible Disclosure
If you discover a security vulnerability, please report it to security@gurulu.io. We follow a 90-day responsible disclosure policy. We will acknowledge your report within 48 hours and work with you to understand and resolve the issue. We do not pursue legal action against good-faith security researchers.
Last updated: April 2026