Security

Security lead

Fahreddin Ergin

Founder & Managing Member, Line Markt LLC

Accountable for the security of the infrastructure Echo Server Solutions operates, for internal security and penetration testing of that infrastructure, and for incident response.

Reporting a vulnerability

Please report security issues to info@echoserversolutions.com. We usually acknowledge receipt within 72 hours and ask that you allow us time to remediate before public disclosure. Machine-readable contact details are published in /.well-known/security.txt.

Internal security testing

We regularly test our own infrastructure, our virtualization and backup servers, for vulnerabilities and misconfigurations. Every test has a written scope and time window set by the security lead in advance. Customer systems and third-party systems are never tested without the owner's written authorization, and findings are tracked until they are fixed or a documented decision is taken.

Scope

This policy covers the websites and infrastructure that Echo Server Solutions operates. If you are unsure whether a system belongs to us, send the report anyway and say what made you think so.

What a useful report contains

• The affected URL, host or service, and the time you observed the issue
• The steps needed to reproduce it, as short as they can be
• What an attacker could achieve with it, in your own assessment
• Any request and response excerpts or screenshots that show the behaviour
• How we can reach you for questions, and whether you want to be named

Reports in English, German or Turkish are equally welcome.

Please stay within these limits

• No denial-of-service testing and no automated scanning at a volume that degrades service
• Do not access, change or delete data that is not yours; stop at the first proof
• No social engineering of staff or customers, and no physical access attempts
• Keep the details confidential until the issue has been fixed

What happens after you report

We confirm receipt, usually within 72 hours, and reproduce the issue. The security lead decides on the fix and its priority, and the finding is tracked in the same way as our internal test results: until it is fixed or a documented decision is taken. Where you left contact details, we tell you once the fix is live so that you can verify it.

How hosted systems are protected

Every site we operate enforces TLS 1.3 as the minimum, internal applications are published through an outbound Zero Trust tunnel without inbound ports, and mail domains publish SPF, DKIM and DMARC at reject policy. The details, including what is deliberately not switched on, are described on the Security and Zero Trust page.