Security and KVKK
In a blind stage, jurors never receive the team name, members or personal fields; filtering happens on the server. This page shows where the answers to procurement questions live inside the product.
Data controller and data processor
For an event's participant, team, submission and jury data, the organizing institution is the data controller and Fauna Venture Studio is the data processor. The relationship is set by the Data Processing Agreement accepted when each organization is opened. For user accounts (name, email, password hash) Fauna is the data controller.
Participants see the organization's privacy notice at registration; items that need explicit consent are asked separately, unticked and never as a condition of taking part. Each consent is tied to the version of the text.
Who sees what
Permissions are checked again on the server for every request; hiding in the interface is not considered enough. Conditional: in a blind stage jurors do not see team identity, other jurors' scores stay hidden until the stage closes; volunteers see only name, short code, team and table, never email or form answers; mentors see only the name and member names of teams that booked them; sponsor representatives see only submissions entered for their own prize.
| Data | Event team | Jury | Other participants | Volunteer | Mentor | Sponsor representative |
|---|---|---|---|---|---|---|
| Participant's name and email | Sees | Does not see | Does not see | Conditional | Conditional | Does not see |
| Registration form answers | Sees | Does not see | Does not see | Does not see | Does not see | Does not see |
| Team name and members | Sees | Conditional | Conditional | Conditional | Conditional | Conditional |
| Submission content | Sees | Sees | Conditional | Does not see | Does not see | Conditional |
| Other jurors' scores | Sees | Conditional | Does not see | Does not see | Does not see | Does not see |
- Participant's name and email
- Event teamSeesJuryDoes not seeOther participantsDoes not seeVolunteerConditionalMentorConditionalSponsor representativeDoes not see
- Registration form answers
- Event teamSeesJuryDoes not seeOther participantsDoes not seeVolunteerDoes not seeMentorDoes not seeSponsor representativeDoes not see
- Team name and members
- Event teamSeesJuryConditionalOther participantsConditionalVolunteerConditionalMentorConditionalSponsor representativeConditional
- Submission content
- Event teamSeesJurySeesOther participantsConditionalVolunteerDoes not seeMentorDoes not seeSponsor representativeConditional
- Other jurors' scores
- Event teamSeesJuryConditionalOther participantsDoes not seeVolunteerDoes not seeMentorDoes not seeSponsor representativeDoes not see
Locked scores and unlock requests
Once a juror locks a score, the evaluation can no longer be changed or deleted at database level. If a correction is needed, the juror opens a reasoned unlock request; the event manager approves it and the previous score is kept as a revision. The public sector template requires two approvers (four eyes).
Minutes and digest
Panel minutes are versioned. A SHA-256 digest of the finalized version is computed and written on the minutes; if the digest on the printed copy matches the screen, the content has not changed. A new version supersedes the old one, which is never deleted.
Audit log
Status changes, role changes, unlocks, bulk emails and exports are written to the audit log, which cannot be updated or deleted. Every export containing personal data requires a reason; who took it, when and why stays on record.
- The log does not store names, emails or IP addresses; people are linked by ID.
- If someone deletes their account, the user row is anonymized and the log stays intact.
- In Excel and CSV exports, cells that start like formulas are neutralized.
Account security and sessions
Passwords are stored as hashes. Every account has optional two-step verification (authenticator app and single-use recovery codes). The session cookie is valid only on the domain where it was created; one organization's session does not work on another's address. Enterprise sign-in (SSO) is not available today; it is on the roadmap.
Cookies
Only essential cookies are used: the session cookie (valid only on its own domain) and language and theme preferences. There are no advertising, tracking or third-party analytics cookies, so there is no cookie banner either.
Where the data lives
The database and files are kept on Cloudflare infrastructure in the European Union region; connections are encrypted. Emails are sent through Resend. These providers are headquartered in the USA, so the transfer counts as a cross-border transfer; its legal basis is written in the Data Processing Agreement.
Hosting in Türkiye is not available today; it will be evaluated later. Organizations whose data must stay in Türkiye (for example public sector data or banking secrecy) should therefore not use Thonie for that data today.
Backups
The database relies on Cloudflare D1's built-in point-in-time recovery. A separate, regular export backup is not set up yet; once it is, its frequency and retention will be written on this page.
Breach notification
Fauna notifies the affected organization within 24 hours of learning of a personal data breach (Data Processing Agreement). As data controller, the organization is responsible for notifying the Board and the data subjects; Fauna provides the information needed.
Penetration testing, certification and SLA
- Independent penetration test: not done yet; no date planned.
- Certifications such as ISO 27001 or SOC 2: none.
- Uptime commitment (SLA): none. It can be discussed in an enterprise contract.
Sub-processors and transfers abroad
The providers used for hosting, email delivery and bot protection, and where data is processed, are listed on the Sub-processors page. The legal basis for transfers abroad is set out in the Data Processing Agreement.