Data Protection & Security
Choosing KVKK-Compliant HR Software: What to Check
What to ask about KVKK when choosing HR software: controller and processor roles, hosting data in Türkiye, access scopes, encryption and deletion requests.
4 min read
Features
Security & Data Protection
Data hosted in Türkiye, strict per-company isolation, scoped permissions and encrypted backups.
HR and task data are among an organisation’s most sensitive information. In the HibritİK cloud service, data is hosted in Türkiye, in Istanbul. Sotech Bilgi Teknolojileri, the company behind HibritİK, is ISO 27001 certified. Each company’s data is strictly separated from the others, and users only see their own organisation’s data.
Access is role- and permission-based, and each permission can be granted at own-record, team, department or whole-company scope. Messages are stored encrypted on the server, backups are encrypted and the history of changes to a task is kept inside the task. Users can see and revoke their active sessions, and an account deletion request anonymises the account after 30 days. These measures help you meet your obligations under KVKK, Türkiye’s personal data protection law.
Use cases
- Organisations that require data to stay in the country
- Managers seeing only their own department’s data
- Revoking the session on a lost phone remotely
- Handling a departing employee’s account deletion request
Highlights
Hosted in Türkiye
Cloud data is kept on servers in Istanbul.
Per-company isolation
Each company’s data is strictly separated; organisations cannot reach each other’s data.
Permission scopes
Permissions are granted at own, team, department or company scope.
Encryption
Messages are stored encrypted with AES-256-GCM, and backups are encrypted.
Session security
Short-lived access tokens, login rate limiting, and the ability to see and revoke sessions.
Account deletion
An account deletion request anonymises the account after 30 days.
Related modules
Related articles
Frequently asked questions
Where is our data hosted?
In the cloud service, data is hosted in Türkiye, in Istanbul. If you want data to stay on your own servers, on-premises installation is also available.
Are messages end-to-end encrypted?
No. Messages are stored on the server encrypted with AES-256-GCM; this is encryption at rest, not end-to-end encryption.
Can we limit which data a manager sees?
Yes. Roles and permissions are defined at own, team, department or whole-company scope, so each user sees only the data they are authorised for.
Other features
Start digitalizing your company today
Try it free for 14 days with every module enabled.