Security and data: What happens to your data, measured on the live server.
How Unique Alphabet® handles your data, measured on the live server and checked in our code. Every section shows the date it was measured.
Measured
At a glance.
| Topic | Unique Alphabet® |
|---|---|
| Hosting | İstanbul, Türkiye, for all accounts (GNET İnternet Telekomünikasyon A.Ş.) |
| Encryption in transit | TLS 1.2 and 1.3; HSTS for two years |
| Encryption at rest | In the app: share links, two-factor secrets and the SMTP password (AES-256-GCM) |
| Sign-in | bcrypt password hashes; optional two-factor with an authenticator app |
| Sessions | 8 hours; httpOnly, Secure, SameSite=Lax; owners and admins can end every session at once |
| Roles | Owner, Admin, Editor, Viewer, enforced on the server |
| Company separation | One database; the application scopes every query to the account in the signed session |
| Audit Log | SHA-256 chain; database triggers reject edits and deletions; CSV export of the last 400 days |
| Export | ZIP per product and the whole account, from the app, on paid plans |
| Deletion | Document files removed at once; a closed account is deleted after 90 days |
| AI | In your account, Label Check and the Assistant are the only places where data goes to an AI service, and one setting turns all AI off. Raw Portal also reads the first page of a supplier’s upload to suggest what it is. |
| Sub-processors | Listed by name in §11; changes announced 30 days ahead |
| Vulnerability reports | dev@uniquealphabet.com · /.well-known/security.txt |
| Last reviewed | 14 Oct 2026 |
Every account is hosted in İstanbul, Türkiye, by GNET İnternet Telekomünikasyon A.Ş. On top of that, the app encrypts share links, two-factor secrets and its own mail password.
| Item | What is in place |
|---|---|
| Hosting provider | GNET İnternet Telekomünikasyon A.Ş., İstanbul, Türkiye |
| Encrypted in the app | Share links, two-factor secrets and the SMTP password, with AES-256-GCM |
| Backups | Encrypted backups off the server every day; a restore is tested every quarter and recorded in the Audit Log. |
Measured
Unique Alphabet® accepts TLS 1.2 and 1.3 and refuses older versions. The headers below are the ones the live server sends; open your browser’s developer tools to compare.
| Header | Value |
|---|---|
| Strict-Transport-Security | two years, includeSubDomains, preload |
| Content-Security-Policy | default-src 'self' · script-src and style-src 'self' 'unsafe-inline' · frame-ancestors 'none' · form-action 'self' · base-uri 'self' |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera, microphone, geolocation and payment off |
The app loads no third-party scripts, fonts, analytics or trackers. Fonts ship with the app.
Measured
Passwords are stored as bcrypt hashes, never as text. Sessions expire after eight hours, and owners and admins can end every open session at once. Two-factor sign-in is available to every user.
| Item | What the code does |
|---|---|
| Password | bcrypt hash; at least 8 characters; common passwords refused |
| Two-factor | Time-based codes from an authenticator app, optional for every user. An owner or admin can reset a member’s two-factor sign-in |
| Email address | The account owner’s address is verified by a single-use link, valid 24 hours, before the first sign-in |
| Session cookie | httpOnly, Secure, SameSite=Lax; expires after 8 hours. Owners and admins can end every open session of the account at once |
| Password reset | 256-bit random link, single use, valid 2 hours; only its SHA-256 hash is stored |
| New user | No password is emailed. A single-use invitation link, valid 72 hours; the user sets their own password |
| Sign-in attempts | 10 per minute per IP address, and 10 failed attempts per 15 minutes per account |
Measured
Every record belongs to one company account, and the server scopes queries to the account in your signed session. Inside the account, four roles decide who can change what.
| Role | Can |
|---|---|
| Owner and Admin | Everything, including members, roles, export and closing the account |
| Editor | Products, formulas, documents, shares, document requests and company details. Not members, not roles |
| Viewer | Read everything. Change nothing. Can export the Audit Log and open a support request |
All companies share one database; the separation is enforced row by row on the server, and automated tests check parts of this boundary on every change. The operator panel our staff use shows account names, email addresses, plans, file counts and the text of support requests you send; it shows no formulas, product files or documents.
Measured
Database triggers refuse any update or deletion of a log entry. Entries are chained with SHA-256, so a later change breaks the chain. Actions that change your data are written to it. You can read the log per file and download the last 400 days as CSV; the download is logged too.
Written to the log
- Sign-ins, successful and failed
- Password resets
- Product, formula, custom mix, toxicology and document changes
- Documents added and deleted
- Report versions and signatures
- Shares created, revoked, renewed, and each view of a share
- Supplier uploads
- AI-assisted results: a SHA-256 digest of the text they were based on, the full result, the prompt version, the model and who accepted or rejected them
- Invitations, role changes, deactivations
- Company logo and notification settings
- Exports
- Regulatory Watch findings closed
- Actions our staff take on your account, with the reason
Not written to the log
- The formulas themselves
- Document contents
- Passwords
- Tokens
Each entry carries the time, the IP address, the browser and the name or email address of the person acting. After 400 days, entries move to a protected archive; nothing is deleted, even when the account is closed.
Measured
The system generates the password, shows it once and stores only its bcrypt hash; send it to your supplier through a different channel from the link. Attempts are limited to 10 per minute per IP address. You get an email when files arrive, at most one every 15 minutes.
Every upload is checked for extension, MIME type and content signature; PDFs are checked for scripts, automatic actions and embedded files, and Office documents for macros. The limit is 20 MB. This is not a virus scan. Requests and uploads are written to the Audit Log.
Suppliers can also reply to the request email with the files attached. The sender is verified with SPF and DKIM. A file from an unverified sender, or one that can’t be matched to an ingredient, is held for review and you’re notified. Files sent by email go through the same checks as uploads. Suppliers who use Raw Portal sign in with a one-time link sent by email, valid for 15 minutes.
Measured
When you delete a document, its file is removed from the server. Products are archived rather than deleted and can be restored from the archive. When a paid plan lapses, the account stays readable for 60 days, downloads included. Closing the account starts a 90-day wait in which you can export everything; then it is deleted.
| Item | What the code does |
|---|---|
| Document deleted | The file is removed from disk at once |
| Product discontinued | Archived and restorable while the account is active |
| Export | One ZIP per product, the whole PIF. The whole account as one archive, from the app, for the owner or an admin. Both on paid plans |
| Account closed | The owner or an admin asks for it. For 90 days the account is read-only and everything can be exported; then data and files are deleted. Billing records and the Audit Log are kept |
| PDFs | Generated on our own server; no outside PDF or OCR service |
Measured
In your account, Label Check and the Assistant are the only places where data goes to an AI service. Raw Portal also reads the first page of a supplier’s own upload to suggest its type; nothing from your account goes with it. Label Check sends the label text you paste (up to 20,000 characters, with email addresses and phone numbers removed), or the label file you upload (PDF or image), without the file name.
Sent
- Label Check: the label text as you paste it, including whatever it contains: brand, Responsible Person address, INCI list
- Label Check: the label file you upload (PDF or image), as it is
- Assistant: your question and the last six turns, with your data as placeholders; a value only when you allow it
Not sent
- Label Check: nothing from the database: no formula records, no percentages, no product record, no company profile, no supplier documents
- Label Check: the name of the uploaded file
- Assistant: your formula values, unless you allow a named field of a named product
How the Assistant handles your data: three layers
Public data, such as regulations and shared toxicology sources, is used as it is. Your own data reaches the model only as placeholders: it sees “[PRODUCT_1] exceeds the limit for this substance”, never your formula values. If a better answer needs a value, the Assistant stops and asks: which fields of which product, and why. You allow it for this question or this conversation, or say no and get an answer that says what it couldn’t know. A permission never covers more than the product and fields named, never outlives the conversation, and is written to the Audit Log and listed in Settings. Your Owner or an Administrator sets the policy: off, ask, or ask an admin.
Assistant conversations are visible only to the person who had them, not to the company Owner or an Administrator, and are deleted 90 days after the last message.
The screen names the model that answered. Every result is written to the Audit Log with a SHA-256 digest of the text it was based on, the full result, the prompt version, the model and who accepted it. The provider is Anthropic, called directly; the code refuses any other provider. One setting switches off every AI operation: the owner or an admin can turn AI off for Label Check and the Assistant in the company settings; while it is off, no text goes to any provider and the rule-based checks still run.
Formula Check, INCI Breakdown, Allergen Calculation, Regulations, Toxicology Data, SDS Authoring, Packaging and the Audit Log use no AI service. Regulatory Watch is rule-based: it matches annex entries to your formulas by CAS, EC and INCI inside our own database, reads only public sources, and sends no customer data anywhere.
Measured
There is no screen in the app through which our staff view your content. We open it only when you ask in a support request, in a security incident, or when the law requires it. Actions our staff take on your account are written to your Audit Log, with the reason.
| Item | What is in place |
|---|---|
| Operator panel | Named accounts, two-factor sign-in at every login, sign-ins logged |
Measured
The companies below process data on our behalf. This is the whole list. When it changes, account owners are told 30 days before the change.
| Purpose | Company | Location | What it receives |
|---|---|---|---|
| Hosting | GNET İnternet Telekomünikasyon A.Ş. | İstanbul, Türkiye | Everything stored in the app |
| AI: Label Check, the Assistant and Raw Portal suggestions | Anthropic | United States | Label text or label file, without file names; the Assistant question and recent turns, with your data as placeholders and values only with permission; the first page of a supplier’s upload, for Raw Portal suggestions |
| GNET İnternet Telekomünikasyon A.Ş., the host’s mail service | İstanbul, Türkiye | Email addresses and the text of notifications |
The same list, with contract parties, is in the Data Processing Agreement. Error reports stay on our own server; no error-tracking service receives them.
Measured
We answer security questionnaires with this page as the source, and sign a Data Processing Agreement on request. Your contract party is Wennes Biyoteknoloji Limited Şirketi, Türkiye.
| Asked for | Where it is |
|---|---|
| Data Processing Agreement | On request: hello@uniquealphabet.com |
| Sub-processor list | §11 · changes announced 30 days ahead |
| Data location | §01 · İstanbul, Türkiye, for all accounts |
| Roles | §04 · Owner, Admin, Editor, Viewer |
| Audit export | §05 · CSV, last 400 days |
| Account deletion | §08 |
| Service status | uniquealphabet.instatus.com |
| Vulnerability reporting | §13 |
Measured
Write to dev@uniquealphabet.com. The app server publishes a security.txt at /.well-known/security.txt. We reply within 2 working days and tell you what we changed.
Common questions about security and data.
Where does Unique Alphabet® host customer data?
In İstanbul, Türkiye, for every account, with GNET İnternet Telekomünikasyon A.Ş.
Does the AI see my formulas?
Not unless you allow it, product by product, field by field. The Assistant sends your data to the model as placeholders, and a value goes only with your permission. Label Check sends the label you check and nothing from the database.
Can we turn AI off?
Yes. The owner or an admin can turn AI off for Label Check and the Assistant in the company settings; while it is off, no text goes to any provider and the rule-based checks still run.
How does Unique Alphabet® keep one company’s data from another’s?
Every record belongs to one company account, and the server scopes queries to the account in the signed session. Automated tests check parts of that boundary on every change.
Does Unique Alphabet® support two-factor sign-in?
Yes. Two-factor sign-in with an authenticator app is available to every user, and an owner or admin can reset a member’s. There is no single sign-on today.
Can Unique Alphabet® staff see our data?
There is no screen in the app through which staff view customer content. We open it only when the customer asks in a support request, in a security incident, or when the law requires it. Actions our staff take on an account are written to its Audit Log, with the reason.
How do we get our data out of Unique Alphabet®, or delete it?
Each product exports as a ZIP with the whole PIF, and the whole account as one archive, from the app, on paid plans. When a paid plan lapses, the account stays readable for 60 days, downloads included. Closing an account starts a 90-day wait in which everything can be exported; then data and files are deleted.
Who are Unique Alphabet®’s sub-processors?
GNET İnternet Telekomünikasyon A.Ş. in İstanbul for hosting and email, and Anthropic for Label Check, the Assistant and Raw Portal’s document suggestions. The full list is in §11.
The headers, the TLS versions and security.txt can be checked by anyone; the rest is what our code does, as we read it on the date shown.
Ask the team that runs the server.
Send your security questionnaire, ask for the Data Processing Agreement, or bring the questions this page does not answer.
- Your questionnaire, answered from this page
- A Data Processing Agreement, signed on request
- Sub-processor changes, announced 30 days ahead
- This page as a PDF, dated, for your file