How public bodies, banks and regulated sectors can choose between cloud and on-premises: data location, KVKK, IT capacity, updates and cost, step by step.
When choosing new enterprise software, “cloud or our own servers?” is one of the first questions on the table — especially in the public sector and regulated industries. It isn’t just a technical preference: it decides where data lives, who is responsible for what, how much work lands on the IT team and what the long-term costs look like.
This article compares the two models even-handedly and covers the questions to ask and the common mistakes. The aim isn’t a universal answer to “which is better?”, but helping you find the right answer for your organisation.
The core difference
In the cloud (SaaS) model, the software runs on infrastructure the provider operates. You use it through a browser or mobile app, and servers, backups, updates and infrastructure security are the provider’s job.
In the on-premises model, the software runs on your own servers, in your own data centre or on infrastructure you control. Data stays within your boundaries — but running servers, backups and infrastructure security largely become your responsibility.
| Topic | Cloud | On-premises |
|---|---|---|
| Time to start | No installation, quick start | Server preparation and installation |
| Data location | Provider’s data centre | Your own infrastructure |
| Operations | Provider | Your IT team |
| Updates | Applied by the provider | Applied when you schedule them |
| Network access | Over the internet | Per your network policy; can be internal-only |
| Cost structure | Usually a recurring subscription | Licence plus hardware, operations and staff |
The questions that decide it for regulated organisations
1. Where must the data live?
This is usually the first and most decisive question. For some organisations, hosting in Türkiye is enough; for others, data must never leave their own infrastructure, by rule or by policy. In the Turkish public sector, instruments such as Presidential Circular 2019/12 on information and communication security measures and the Digital Transformation Office’s Information and Communication Security Guide set the framework for classifying data and deciding where it may be stored. Banking, healthcare and energy may add rules from their own regulators.
So the first step is to work out, with your information security and legal teams, which class your data falls into and which rules apply to you.
2. What changes under KVKK?
Türkiye’s Personal Data Protection Law (KVKK, No. 6698) doesn’t remove your obligations as data controller whichever model you pick. The general principles in Article 4 — lawfulness and fairness, accuracy, specific and legitimate purpose, limitation and proportionality, retention only as long as necessary — and the duty in Article 12 to take technical and organisational measures apply in both cases.
What changes is how responsibility is shared. In the cloud, the provider is usually a data processor, so the relationship needs a contract and the provider’s security measures need assessing. If data would be transferred abroad, Article 9 on cross-border transfers (as amended in 2024) needs separate review. On-premises, the transfer question largely disappears — but all of the infrastructure security is on you.
3. Does your IT team have the capacity?
On-premises doesn’t mean install and forget. Monitoring servers, patching operating systems and databases, taking backups and regularly test-restoring them, access control and incident response all take ongoing effort. Without that capacity, an on-premises setup that looks safer on paper can end up weaker in practice.
4. Who applies updates, and when?
In the cloud, the provider applies updates and new features reach everyone at once. On-premises, you schedule updates yourself — an advantage for organisations with strict change management. But deferring updates for long means security patches and new features arrive late.
5. How should total cost be compared?
Comparing only licence or subscription fees is misleading. On-premises, add hardware, virtualisation, backup infrastructure, power, data-centre space and, above all, the time of the people who run it. In the cloud, consider the recurring cost by users and modules, and the reliability of your internet connection.
Common mistakes
- Assuming on-premises is always more secure: security depends more on how data is protected than on where it sits.
- Equating cloud with abroad: cloud services can run from data centres in Türkiye — ask the provider where data physically lives.
- Not checking whether the on-premises edition is cut down: some vendors ship a separate, more limited on-premises product. Clarify this before choosing.
- Skipping the trial: even if you’ll go on-premises, trying the product with your own processes first reduces the risk of investing in the wrong tool.
Decision checklist
- Identify the class of data you’ll process and the rules that apply to you.
- Decide whether data must stay in the country or on your own infrastructure.
- Assess your IT team’s operations, backup and security capacity honestly.
- Write down your expectations for updates and change management.
- Compare total cost of ownership with every item included.
- Ask the vendor whether the on-premises edition is the same as the cloud one.
HibritİK: two options, one piece of software
HibritİK lets you make this decision based on your needs, with no feature difference between the two:
- Cloud: use HibritİK at app.hibritik.com with no installation. Cloud data is hosted in Istanbul, Türkiye, and each company’s data is strictly isolated.
- On-premises: install the same software on your own servers, with data and application running on your infrastructure. It isn’t a separate or reduced edition.
- Per-module licensing: in both cases you license only the modules you need; unlicensed modules don’t appear in the interface.
- Security measures: role- and permission-based access (own records, team, department or company scope), messages encrypted at rest on the server, encrypted backups and session management. Sotech Bilgi Teknolojileri, which builds HibritİK, is ISO 27001 certified.
- Integration: a REST API with role-scoped API keys, so what an integration can reach is limited from the start.
For details, see cloud and on-premises, security and data protection and integration and custom development. Our article on KVKK-compliant HR software covers what to look for from a data protection angle.
Conclusion: choose the need first, then the model
Cloud versus on-premises is an organisational policy decision, not a product feature. Once you’re clear on your data class, the rules that apply and your IT capacity, the right model often becomes obvious. To discuss an on-premises installation, get in touch; to try the product in the cloud first, start your 14-day free trial.
Note: this article is for general information. Please confirm the laws and regulator rules that apply to your organisation with your information security and legal teams.