Information security
We run information security through a management system built to ISO/IEC 27001: access rights are granted by role, data is encrypted in transit and at rest, and backup and recovery are tested regularly.
For us information security is not a product feature but a way of working. Below is how we protect customer data in concrete terms — daily practice, not certificate numbers.
- Role-based access control
- Encryption in transit and at rest
- Regular backup and recovery testing
- KVKK-compliant data processing
Security as a management system
We run information security through a management system built to ISO/IEC 27001. This means security depends on processes, not on people: who may access which data, what is done when an incident occurs, how access is closed when an employee leaves — all written down and reviewed regularly.
The same system applies to our own products. A restaurant’s sales data, a clinic’s patient record and a law firm’s case file are protected by these rules every day.
Access and permissions
Access is role-based: the doctor, the receptionist and accounting use the same system with different rights. Administrator accounts are kept separate and critical actions are logged. The same principle applies to client projects; there is no “everyone sees everything” default.
- Role-based permissions
- Separate administrator accounts
- Action and access logs
- Access-closure process for leavers
Data protection
Data is encrypted in transit and at rest. Backups are taken regularly and restores are actually tested; a backup that has never been restored is not a backup. Customer data belongs to the customer: at the end of a contract it is exported and handed over.
For personal data we work to Turkish data-protection (KVKK) obligations: data minimisation, purpose-limited processing, access logging and defined retention periods.
- Encryption in transit and at rest
- Tested backup and restore
- KVKK-compliant processing
- Data handover at contract end
Security in projects
Security is part of the design from day one, not a check added at the end. The permission model is built together with the data model; dependencies are updated regularly; a security review happens before go-live. Every integration to a provider (payment, e-invoicing, banking) is tested under that provider’s security conditions.
Frequently asked questions
Where is our data stored?
Our products run on MTY Cloud; for client projects we can also deploy to your own servers if you prefer. Where data is kept is written into the contract.
What happens in a security incident?
The incident process is defined: the incident is recorded, its impact contained, affected customers informed and the root cause fixed. The process is reviewed regularly as part of the management system.
Can we run a penetration test?
Yes. We are open to tests by your own security team or an independent firm; we plan scope and timing together.
Quick quote
Tell us what you need for Information security and our specialists will get back to you.
or call 0324 606 06 66