Skip to content
0531 374 28 21 onurlutesbihane@gmail.com
Shipping across Türkiye · 14-day return right
Corporate

Platform Infrastructure and Capabilities

Onurlu Tesbihane is not merely a shop window; it is an end-to-end e-commerce platform, from marketplace integration to the loyalty programme, from multi-language export infrastructure to automated testing. Every item below is running live right now as a capability.

Corporate identity
Founded
2019
Registered trademark
2021/1539832021 — Turkish Patent and Trademark Office
Trademark classes
14, 3514: jewellery · 35: retail services
43.000+ lines of application code
236 end-to-end pages / endpoints
124 admin panel screens
99 versioned database migrations
72 automated test suites
4308 assertions run on every deployment

Marketplace Integration

  • Live API connections to 8 marketplaces: Trendyol, Hepsiburada, n11, Çiçeksepeti, Pazarama, PTT AVM, Amazon, Trendruum
  • One-click price / stock updates and product activation from the panel
  • Store connection and product matching screens for 10 marketplaces
  • Multi-platform matching through a shared product code (SKU)
  • Dry-run mode: shows exactly what would be sent before going live
  • All marketplace orders on one screen, with a filter for those awaiting invoicing
  • Encrypted backup and restore for API keys

Orders, Payment and Shipping

  • 3D Secure card payment via PayTR (card details are never stored on the site)
  • Stripe and PayPal infrastructure is ready and switched OFF (activates once keys and an exchange rate are entered)
  • Secure payment confirmation through PayTR callback signature verification
  • Card payments via Stripe Checkout — card details never touch this site, and webhook signatures are verified
  • PayPal Orders v2 — the capture is made server-side; the browser's claim of payment is never trusted
  • The amount charged is always read from the order in the database; underpayment and wrong currency are rejected
  • The same payment notification is never processed twice; every accepted and rejected notification is logged
  • For foreign-currency charges the conversion happens server-side and the amount is shown before payment
  • WhatsApp order confirmation flow — for a single item or the whole basket
  • Server-authoritative pricing: every discount is computed from the database; client input is never trusted
  • Guest and member checkout; a saved address book for members
  • Order status management (being prepared / in transit / delivered / cancelled)
  • Signed private tracking link — the address is not exposed to whoever holds the link
  • Automatic stock deduction, with stock restored on cancellation and returns
  • Carrier selection (9 companies) and tracking-number management
  • Carrier API integration: create shipments with Aras, MNG and Yurtiçi Kargo
  • International shipping: create and track shipments with DHL Express, UPS and FedEx
  • For international parcels the weight is computed from product records; any estimated item is reported openly
  • Customs declarations are prepared automatically; the declared value comes from the real order total and cannot be lowered by hand
  • An international shipment is not created while the sender details are incomplete — each missing field is named
  • Open a shipment in one click from the panel — the tracking number is written automatically
  • Tracking status of dispatched orders is refreshed by an hourly cron
  • Dry-run mode for the carrier integration — verify before going live
  • ERP export bridge: orders are exported as CSV, XML or JSON for import into Logo/Mikro/Nebim
  • Signed webhook to ERP middleware: every order is sent with an HMAC-SHA256 signature
  • Delivery is queued — order flow never stops while the receiver is down, nothing is lost, the last error stays visible
  • VAT is split per line item on export, and exported orders are stamped so nothing is booked twice
  • e-Invoice / e-Archive integration: one-click invoicing with Nilvera and Paraşüt
  • Invoice totals and line items are read from the database; the VAT base is separated automatically
  • Duplicate-invoice protection and an invoice preview (dry-run) mode
  • Automatic order confirmation and shipping notification e-mails (Resend infrastructure)
  • VAT transparency: the VAT share is shown separately in the order summary
  • Installment messaging on the product, basket and checkout steps; maximum instalments and minimum amount set from the panel
  • Personalised production: a name/engraving field on the product; the surcharge is computed server-side and cannot be altered by the client
  • The withdrawal-right exemption for personalised items is disclosed to the customer before ordering
  • Out-of-stock items collect “notify me” requests; the list appears in the panel once the item is back
  • Live stock hold at checkout: the quantity in the basket is held in the customer's name and released when it expires
  • Last line of defence against overselling: availability is re-verified at order time, minus quantities held by others
  • Quote (RFQ) flow: quote requests on high-value items, line-by-line pricing, tokenised quote page
  • Corporate bulk order: a product-code and quantity list is validated server-side and turned into a quote with tax details
  • Printable quote document (saved as PDF from the browser) — with seller/buyer details and a validity date

Growth, Campaigns and Loyalty

  • Browser push notifications: reach phones and desktops without an app; nothing is sent unless the visitor opts in
  • Notification payloads are end-to-end encrypted (RFC 8291) — not even the push server can read them
  • Subscriptions that have become invalid are cleaned up automatically on the first send
  • Members whose order ships get a notification — only if they opted in
  • Affiliate / influencer programme: personal links, a 30-day attribution window and automatic earnings
  • Partners see their own clicks, orders and earnings; they cannot change their rate or see any customer data
  • An order pays exactly one commission — a partner and an affiliate are never paid for the same sale
  • Earnings are frozen at the moment of sale; changing a rate later never rewrites past payouts
  • The click counter keeps only a daily total — no visitor IP or browser data is stored
  • Meta (Facebook/Instagram) catalogue feed — XML and CSV; Meta fetches the feed on its own schedule
  • Google Ads conversion tracking — with the order total and order number; the same order is never counted twice
  • The Meta pixel and Ads tag load only after the visitor accepts cookies; with no ID entered they are not printed at all
  • The catalogue price is the price on the site — no gap between the ad and the landing page
  • Campaign engine: automatic discounts by basket percentage, basket total or category
  • Date-bounded campaigns; the most advantageous one is selected automatically
  • Coupon system: usage limit, validity dates, minimum basket total
  • Loyalty points: earned automatically on delivery, spent at checkout (with double-earning protection)
  • Abandoned-basket recovery — automatic reminder e-mail via an hourly cron
  • E-mail newsletter: duplicate-signup protection, admin list and CSV export
  • Favourites (wishlist), live search suggestions and a quick-view modal
  • Gift wrapping option — server-computed fee plus a gift note
  • A 'Best seller' badge based on real sales data (not invented)
  • Sale price display (struck-through old price plus percentage)
  • Product variants (length / bead / imame) — price and stock per variant
  • GA4 e-commerce events: product view, add to cart, purchase
  • Marketing automation: welcome, post-purchase care guide, review invitation and win-back flows
  • Flows are scanned by an hourly cron; each flow's delay and on/off state is managed from the panel
  • Customer segments computed from live data: new member, one-time buyer, repeat, high-value, lapsed, subscriber
  • Consent gate: commercial messages go only to addresses with explicit newsletter consent — placing an order is not consent
  • Every commercial message carries a one-click unsubscribe link (HMAC-signed, applied immediately)
  • The same flow is never sent to the same person twice (send log is de-duplicated)
  • Personalised product recommendations: unbought items in categories already purchased, co-purchases and real sales counts
  • "Customers who bought this also bought" on the product page — never shown without evidence

Dealers, Dropshipping and Partnerships

  • B2B wholesale portal: automatic discount and a dealer badge for approved dealers
  • Two partner models: sales partner (commission) and wholesale dealer (buy-and-resell discount)
  • Dropshipping dealer portal (/bayi): the dealer places orders in the end customer's name using their own tracking number
  • One click turns a dealership application into a dealer account: a temporary password is generated and shown to the admin once
  • Dealer purchase price is set SERVER-SIDE — dealers cannot alter their own debt; per-product fixed price or percentage discount
  • No priced document goes in the box on a dropshipping order; the end customer never sees our price
  • Dealer current account: order debt, payments and balance; cancellations and returns are deducted automatically
  • A credit limit can be set per dealer: once the balance reaches it, no new order is possible until they pay
  • A returned order restores stock and claws back every commission; reversing a return deducts stock again
  • No end-customer invoice is issued for a dropshipping order — the sale was made to the dealer
  • Per-dealer barcode suffix — two dealers never land on the same marketplace listing and undercut each other
  • Dealer stock feed (CSV): real stock, purchase price, product page and image URL; our cost never leaks
  • Product photo and a link to its page on our site in the dealer catalogue — listing is quick
  • If no dealer discount is set, both the dealer and the admin are warned; nothing is sold at list price by accident
  • Dealer price is built in two steps: a base (list minus discount, or the real cost) plus a brokerage rate — all server-side
  • Supply cost is frozen at order time, so past records survive later purchase-price changes
  • Bulk cost entry: hundreds of products on one screen, optionally filled as a percentage of the list price
  • Margin screens are admin-only; cost never appears in the dealer panel, catalogue, CSV or listing file
  • The dealer panel is a real admin screen split into sections: overview, catalogue, orders, account, connections, guide
  • Dealers connect their OWN marketplace account: Trendyol, Hepsiburada, N11, Çiçeksepeti, Pazarama, PTT AVM, Amazon, Trendruum
  • Orders, delivery address, phone and tracking number are pulled from all eight marketplaces
  • Bulk listing file: the dealer picks products (select-all, category filter) and downloads a CSV filled with their own barcode and title
  • Dealers set a title prefix/suffix and store name — two dealers never land on the same listing
  • Dropshipping dealers also earn from site sales: their own referral link, a 30-day attribution window, earnings tracked in the panel
  • Referral share is separate from dropshipping margin; one order never pays both partner and referral commission
  • Buying through your own link with your own account earns nothing; cancellations and returns claw the commission back
  • Their marketplace orders land in the panel; one click opens the order with us, customer address and tracking number pre-filled
  • Marketplace orders are pulled automatically by an hourly cron, with exponential back-off on repeated failures
  • Second-tier partner share (OFF by default): paid only on a downline's real sales, never for recruiting, capped at two levels
  • The same marketplace order cannot be opened with us twice; line items match the catalogue via the dealer's own barcode
  • A dealer's API key is never printed back to the screen, is invisible in the admin panel, and can be removed at any time
  • Marketplaces that require a free-form endpoint are never offered in the dealer panel (SSRF protection)
  • Admin screen for dealer marketplace orders: who sold what, and how much of it reached us
  • Partner panel: their own login, sales list and earnings summary
  • Centre-led price and stock: one price, one stock pool — no overselling, no price confusion
  • Orders are assigned to a partner automatically by referral link or city match
  • Earnings tracking: earned, paid and outstanding balance; payments recorded by the centre
  • Commission on a cancelled order is reversed automatically (financial consistency)
  • A dedicated referral link (?ref) per dealer — sales it brings are credited for 30 days
  • A public store page for every dealer (/magaza/<name>) with Store schema (local SEO)
  • Dealership application form and management flow (showroom / shop-in-shop / online / wholesale)

Export: Multi-Language and Multi-Currency

  • Turkish, English and Arabic interface — the entire purchase funnel is translated
  • Full RTL (right-to-left) layout for Arabic with a separate stylesheet layer
  • Multi-currency display: ₺ / $ / € / ﷼ (settlement is always in ₺)
  • Currency defaults to the visitor's language; an explicit choice is remembered
  • Date format and number separators are localised per language
  • hreflang alternates on every page — search engines match the right language
  • Automatic language suggestion from the browser (Accept-Language)
  • Language fields for product, blog and setting text; the Turkish original shows when a translation is empty
  • Policy pages and the distance sales contract are readable in all three languages, with a notice that the Turkish text prevails
  • Browser-rendered interface too (basket panel, quick view, search) is in the visitor's language
  • Order confirmation, shipping notification and basket reminder e-mails are sent in the customer's language (RTL in Arabic)

SEO and AI Visibility (GEO)

  • Open to AI search engines: robots.txt explicitly allows 23 AI crawlers
  • llms.txt — brand facts, a materials glossary and FAQs for AI answer engines
  • ai.txt — content usage policy and attribution preference
  • Schema.org: Organization, Store, WebSite, Product, Offer, FAQPage, Review, BreadcrumbList, SoftwareApplication
  • Shipping time, return policy and price validity inside the product schema
  • Structured product specifications (material, bead count, size, imame) enter the schema as additionalProperty
  • Wikidata entity link (sameAs + identifier) — a Knowledge Graph signal
  • Automatic sitemap.xml (including product images and category pages)
  • Google Merchant Center product feed (merchant.xml)
  • Yandex and Bing site verification support
  • PWA: installable like an app on mobile, with an offline-capable service worker
  • Performance: versioned critical CSS/JS, lazy image loading, font preloading

Admin Panel

  • 124 separate admin screens — products, orders, members, partners, coupons, campaigns, blog, reviews
  • Sales dashboard and reports: revenue, order count, period comparison
  • Low-stock alerts and bulk price update tools
  • Product reviews are not published without editorial approval (spam protection)
  • Return / cancellation request flow — customer request and admin decision screens
  • Live support chat — visitor messages answered from the panel
  • Notification bell: new orders, messages, returns and dealership applications at a glance
  • Category management and a blog publishing system
  • One-click JSON backup of all site data (products, orders, members, everything)
  • Sales-channel breakdown: which partner sold each order, as a column and a filter in the list
  • Per-partner revenue, commission and outstanding earnings report
  • Partner password management: partners change their own, the centre can reset it
  • English/Arabic translation fields for products and blog posts — the Turkish original is published when empty
  • Profitability report: gross profit and margin — only from sales with a recorded cost, and the coverage ratio is stated plainly
  • Cost is copied onto the order line at the moment of sale; changing it later does not distort past reports and it is never shown to customers
  • ABC (Pareto) stock analysis: A/B/C classification by contribution to revenue
  • Demand forecast: daily sales rate by moving average, days of stock cover and a reorder suggestion (not AI)
  • Multi-warehouse: per-warehouse stock distribution, warehouse assignment by city, mismatch warning
  • Live sales screen: today's revenue, latest orders and held stock (refreshed every 15 seconds)
  • VAT rate by country — for the breakdown only; the amount charged does not change and the rate is recorded on the order

Security and Compliance

  • Legal page infrastructure compliant with Turkish consumer (6502) and data protection (6698) law
  • Distance sales contract, pre-information form and right-of-withdrawal flow
  • Company identity details, ETBIS registration number and verification QR code (Law no. 6563)
  • Certificate-of-authenticity badge — set only on items that genuinely ship with a certificate
  • Cookie consent: analytics load only if the visitor accepts (prior consent)
  • Passwords are hashed irreversibly; sessions use signed cookies
  • HTTPS enforced, with security headers (CSP, X-Frame-Options, nosniff)
  • Card details are never held on the site — payment runs on PayTR's infrastructure
  • Form protections: honeypot, input validation, open-redirect prevention
  • Two-factor authentication (TOTP · RFC 6238): a 6-digit code alongside the password at login
  • 2FA only turns on after a valid code is verified — locking yourself out with a mistyped key is impossible
  • Single-use backup codes: only the hash is stored and the plain codes are shown exactly once
  • Brute-force rate limit: failed-attempt cap per IP; the counter only counts attempts after the last successful login
  • Security event log: login, 2FA, backup-code and rate-limit events — passwords, codes and tokens are NEVER written
  • Suspicious-IP report, with log rows pruned automatically after 90 days
  • Static security scan on every deploy: embedded secrets, eval, cookie strictness, security headers, unauthorised POST endpoints
  • Passwordless sign-in with passkeys (WebAuthn): the private key never leaves the device, only the public key is stored
  • Phishing resistance: the browser signs only for the genuine domain, so a passkey simply does not work on a fake site
  • Complete passkey verification: origin, rpId hash, user-presence flag, single-use challenge and ES256/RS256 signature
  • Cloned-device detection: sign-in is refused if the signature counter goes backwards

Multi-Tenant Storefront (SaaS)

  • White-label multi-tenant storefront: an outside company goes live under its own domain and brand
  • Host-based tenant resolution — brand name, title, contact details and social channels change per storefront
  • Subscription management: plan, monthly fee, trial / active / suspended / cancelled state and end date
  • A storefront whose subscription lapses or is suspended closes for sales automatically — no orders, no products shown
  • Storefront scope: only the selected categories are published to a tenant; out-of-scope products do not open there
  • Orders placed on a tenant storefront are credited to the partner that tenant belongs to
  • The tenant manages its own brand face; domain, plan and subscription remain with head office only
  • Seller identity (trade name, MERSIS, trade registry, ETBIS) cannot be replaced by the tenant brand — the real seller stays on the imprint
  • The head-office domain can never be assigned to a tenant, and the admin panel does not open on a tenant domain
  • Subscription payment records plus per-tenant order and revenue summary

Artificial Intelligence (catalogue-grounded)

  • AI infrastructure is ready and switched OFF (activates once a provider key is entered)
  • The customer assistant builds answers only from context supplied by the database — the model is not used as a source of facts
  • Server-side output audit: an answer containing a price or delivery time absent from the context is not published; it is handed to a human
  • Prices and stock on the product cards printed beside the answer are read straight from the database
  • Prompt-injection separation: the customer message is sent in its own block, labelled as data rather than instructions
  • Photo product search: the model only extracts attributes, matching happens in the catalogue — the model cannot pick a product
  • Product description drafts: written only from the attributes entered, never saved automatically, the admin approves
  • Audit log: every request, the number of sources supplied and how often the guard fired are all measurable
  • Daily request quota and rate limiting protect against cost overruns and abuse
  • A single master switch turns every AI feature off instantly; while off, no model call is made at all

Technology and Quality

  • Edge architecture on Cloudflare Workers — no server maintenance, global speed
  • Cloudflare D1 database; 99 versioned schema migrations
  • Automatic background jobs through scheduled tasks (cron)
  • Automated testing, migration and deployment with GitHub Actions (CI/CD)
  • 72 automated test suites / 4308 assertions — run on every deployment
  • Translation leak guard: pages are rendered in English and Arabic and scanned for leftover Turkish
  • 43.000+ lines of maintainable, modular application code
  • Zero licence cost: designed to run on free tiers

For technical questions, corporate collaboration or wholesale/dealership enquiries, reach us from our contact page . For dealership models, see the Wholesale / Partnership page.