Security and KVKK

Controls

Office boundary

Each firm’s records are tied to its own account. No other firm can see them.

Roles

What each person on your team can see and do is set by role. Permissions are also checked separately on the server.

Two-step verification

A second step at sign-in. In settings you can make it mandatory for everyone in the office.

Allowed IP list

Open sign-in only to the addresses your office defines. An address that is not on the list cannot sign in.

Audit log

Changes in the office are recorded: who did what and when.

Support access

The support team enters your account only with your approval. Every access is logged and can be revoked.

E-signature PIN

The PIN is encrypted in the browser and only the Connector on the computer holding the card can decrypt it. The server, the database and the logs never see the PIN. The card never leaves its computer.

Card visibility

For each e-signature card you decide who can see and use it: the whole office, people you pick, or only the card owner.

Document verification

Document verification uses a SHA-256 fingerprint. PDF comparison happens in the browser and the file never leaves your device.

Practice

Where data lives

Servers are managed by Ankara Yazılım and located in Hetzner Online GmbH's data centers in the European Union. Personal data is therefore hosted outside Turkey.

Consent at sign-up

When you open an account, the terms of use, the preliminary information form, the distance services agreement, the data processing agreement and the KVKK privacy notice are each accepted separately.

Continuous scanning

Secret, dependency and rule scans run on every code change. The nightly scan runs only against the test environment.

Reporting a vulnerability