Security & Architecture
BioBitki Technologies · Security Officer: Mert YILDIZ · Eskişehir, Türkiye
In-Transit & At-Rest Encryption
All API payloads and telemetry stream via TLS 1.3. Persistent project records are encrypted with AES-256.
Zero AI Model Training
Client site specifications and soil data processed through Anthropic Claude API are never retained for model retraining.
SOC 2 Alignment
Continuous posture monitoring with strict role-based access control (RBAC) and automated vulnerability scans.
1. AI Model Governance & The Claude API Integration
At BioBitki, architectural drawings, geospatial boundary data, and proprietary masterplan blueprints represent mission-critical intellectual property for our clients.
When BioBitki invokes Anthropic's Claude 3.5 API to solve botanical companion pairings or compute irrigation abatement curves:
- Customer data is ephemeral and strictly stateless during inference.
- Prompts and outputs are never routed to training sets or shared between enterprise tenants.
- Tokens are encrypted in flight through TLS 1.3 end-to-end tunneling.
2. Infrastructure and Cloud Perimeter
BioBitki's cloud application workloads reside in ISO 27001 and SOC 2 certified European datacenters. Our infrastructure enforces:
- Automated Secret Vaulting: API keys and database credentials are stored in encrypted hardware security modules (HSMs).
- DDoS & Web Application Firewall (WAF): Edge protection against automated scraping and volumetric attacks.
- Audit Logging: Immutable tamper-evident audit logs capturing every administrative API transaction.
3. Vulnerability Management & Incident Response
We perform weekly automated static application security testing (SAST) and software composition analysis (SCA) on all simulation microservices. Any identified critical vulnerabilities are patched within a mandatory 24-hour turnaround SLA.
4. Responsible Disclosure & Security Contacts
We welcome vulnerability disclosures from independent security researchers and enterprise security teams.