Legal & Governance · ISO/IEC 27001 & Sovereign Alignment

Information Security Policy (ISMS)

Statement of alignment with ISO/IEC 27001 Information Security Management Standards, air-gapped DevSecOps pipelines, and sovereign sensitive data handling principles.

1. Purpose & Scope

At Periscube, protecting the confidentiality, integrity, and availability of mission-critical enterprise and defense information assets is our highest operational priority. This Information Security Policy applies to all principal architecture, data engineering, sovereign cloud, and DevSecOps engagements delivered from our Istanbul and London hubs.

2. Core Information Security Commitments (ISO/IEC 27001 Aligned)

01 · Confidentiality, Integrity & Availability (CIA Triad): We protect all corporate, regulatory, and defense-related information assets against unauthorized access, alteration, disclosure, or destruction.
02 · Air-Gapped & InfraCo/PlatCo Sovereign Execution: All database tuning, self-hosted LLM inference, ELT/ETL pipelines, and DevSecOps automation execute 100% inside the client's air-gapped infrastructure or onshore PlatCo control plane, eliminating US CLOUD Act telemetry exposure.
03 · Multi-Jurisdictional Statutory Compliance: We strictly adhere to UK Official-Sensitive handling rules, EU GDPR / AI Act / DORA / CADA SEAL-3 / SecNumCloud / C5, and Turkish KVKK Law No. 6698/7499, Cybersecurity Law No. 7545, and BDDK Private Cloud mandates.
04 · Confidential Computing, HSM & PII Airlocks: We enforce CPU/GPU Trusted Execution Environments (TEEs) with cryptographic memory attestation, customer HSM key custody, TDE / TLS 1.3, and inline format-preserving PII tokenization (KVKKVault AES-256-GCM / HKDF).
05 · DevSecOps, Hermetic Artifacts & Daemon Hardening: Every CI/CD pipeline integrates automated SAST/DAST, Harbor air-gapped registries, offline hermetic uv Python wheels, CIS-hardened Packer Golden AMIs, and systemd daemon sandboxing (ProtectSystem=strict, NoNewPrivileges=true).
06 · Least-Privilege Access & Auditability: Role-Based Access Control (RBAC), multi-factor authentication (MFA), and immutable database/infrastructure audit logs are enforced across all systems.
07 · Continuous Risk Assessment & Incident Readiness: We conduct proactive vulnerability assessments, architectural threat modeling, and continuous improvement of our Information Security Management System (ISMS).

Security & Compliance Contact: For security questionnaires, enterprise procurement audits, or ISO/IEC 27001 documentation requests, contact hello@periscube.com or visit our Corporate Identity page.