Client data does not leave the firm.
HukukBis is law firm software for Turkey, delivered by HukukBis and run in-country on MTY Cloud, MTY's own cloud infrastructure. Only the provider of a connector you use receives the data that function needs.
- Session
- MFATwo-step verification and timed sessions
- Access
- ~85 permissionsDetailed, role-based permissions
- Data
- Per companyEach company's data is kept apart
- Documents
- Mandatory scanEvery file is scanned on upload
- Infrastructure
- MTY CloudIn-country, on MTY's own cloud
- Backup
- AutomaticBackups are kept inside MTY Cloud
Client data is protected in four layers
Access, application, data and infrastructure sit on top of one another; a request cannot return a result without passing through each of them.
The path of one request
Lawyer A opens the case list. Before any result comes back, the request passes four gates; if it stops at one, the list does not open.
09:12:00 The sign-in is verified
09:12:00 The sign-in is verified
- Layer 01/04 · Access
Signing in takes more than one password
Sign-in runs over an encrypted connection with a secure session. Two-step verification (MFA) adds a second step to the password, so a stolen password alone does not open the account.
Strong password rules apply and sessions stay open for a limited time. A suspicious session is revoked, and the access of a member removed from the firm closes immediately.
- Encrypted connection
- Two-step verification
- Strong password rules
- Immediate access removal
Secure access - Layer 02/04 · Application
Everyone sees only what the job requires
Detailed, role-based permissions decide who can do what across cases, clients, documents, billing, AI and integrations. You split the permissions into roles that fit your firm, and a user cannot grant anyone more than their own authority.
Owner protection stops a delegated permission from changing the owner's role. Search and dashboard cards depend on permissions too: a record you may not see stays out of results and dashboards. Important actions are written to the audit log.
- Layer 03/04 · Data
Each company's data is kept apart
Company-level isolation is the base of the architecture: every action is bound to the company identity of the session, and a record of another company can never enter a result. Integration keys and mobile device details are stored encrypted.
Every uploaded file goes through type, size and content checks, followed by a mandatory malware scan. A file that proves harmful or cannot be scanned is rejected. Documents past their retention period are handled by the rule you set.
Document securityGuide to legal document security and e-signature
- Layer 04/04 · Infrastructure
MTY Cloud: MTY's own cloud
HukukBis runs on MTY Cloud, MTY's fully own cloud infrastructure. It is located in-country and designed for redundancy and low latency. Traffic travels over an encrypted connection and repeated failed sign-in attempts are limited.
Your data is backed up automatically, the backups are kept inside MTY Cloud and records are restored from backup after any data loss. The service runs with a 99.9% uptime SLA and planned maintenance is announced in advance.
HukukBis AI, a separate package, runs on the same infrastructure: requests are processed by a local model on MTY Cloud, entirely in-country. No data leaves Turkey for AI, and client data is never used to train the model.
Data migration and backupContractual SLA in the Enterprise plan
MTY Cloud data centre
Compliance with Law No. 6698 is backed by data tools
KVKK is Turkey's personal data protection law. For HukukBis, HukukBis prepares the data processing inventory and the impact assessment; which data is processed for what purpose, for how long and with which service provider is on record.
As the data controller, you are responsible for the privacy notice you give your own clients; we publish our own notice separately. The KVKK data tools make two jobs easier: data export and handling deletion requests. When a data subject asks for a copy of their data you export it, when a deletion request arrives you process the record, and retention periods follow the rule you set.
| Data | Data controller | Data processor |
|---|---|---|
| Client, case and document data | Your firm | HukukBis (HukukBis) |
| Account, subscription and invoice data | HukukBis | Sub-processors (for example the payment provider) |
| Website form and newsletter data | HukukBis | Sub-processors |
Read the KVKK privacy noticeRead the privacy policyOpen the KVKK compliance guide
The service providers that receive data are listed openly
Each service provider only comes into play when you use the matching feature, and receives only the data that function needs. AI is not on this list: when HukukBis AI is enabled it runs on a local model on MTY Cloud, in-country.
- iyzico
- Online payment and collectionPayment amount and invoice reference
- Microsoft
- Outgoing emailRecipient address and message content
- SMS provider
- SMS notificationsRecipient number and message text
- Meta (WhatsApp)
- WhatsApp notificationsRecipient number and message text
- Mobile notification provider
- Mobile push notificationsDevice key and notification text
- Weather data provider
- Weather cardCompany location
- Image delivery provider
- Delivery of site imagesCarries no client data; public images only
Built and run with the assurance of HukukBis
HukukBis is developed and operated by HukukBis, which holds an ISO/IEC 27001 certified information security management system and TSE certified software development and quality management processes.
The certificates belong to the company's management system and processes; the product's technical controls are described on this page and in the service agreement.
- ISO/IEC 27001HukukBis's information security management system is certified; HukukBis is developed under its processes.
- TSESoftware development and quality management processes are TSE certified.
- 10+ yearsHukukBis has more than ten years of software experience.
- MTY CloudThe infrastructure is MTY's own cloud and sits in-country.
- 99.9% SLAThe service runs with a 99.9% uptime SLA; planned maintenance is announced in advance.
- KVKKA data processing inventory and an impact assessment are prepared.
- In-country AIHukukBis AI runs on a local model on MTY Cloud; no data goes abroad.
What do firms ask about security?
- 01/06
Where is my data hosted?
HukukBis runs on MTY Cloud, MTY's fully own cloud infrastructure. It is designed for redundancy and low latency; hosting details are set out in the service agreement.
- 02/06
How often are backups taken?
Your data is backed up automatically and the backups are kept inside MTY Cloud. The backup interval and retention period are stated in the service agreement. You can also export your data as Excel and CSV at any time.
- 03/06
What happens to my data when I close my account?
Before closing, you can take your data with the export tool. Your deletion request is handled with the KVKK data tools, and records are deleted or anonymised under the retention rules.
- 04/06
What data does the AI receive, and does it leave Turkey?
Only when you enable HukukBis AI, the separate package, and use the AI assistant, the text you type or select is processed; if you do not use the feature there is nothing to process. Processing happens on a local model on MTY Cloud, entirely in-country; no data is sent abroad for AI and it is not used to train the model. Usage is tracked against the package's monthly request quota and the output always goes to a lawyer for review.
- 05/06
How can I report a security vulnerability?
Send it through the form on the contact page and write security report as the subject. We review the report and get back to you after verification.
- 06/06
Does the ISO 27001 certificate apply to HukukBis?
The ISO/IEC 27001 and TSE certificates are held at company level: they cover the information security management system and the software development and quality processes of HukukBis, which develops and operates HukukBis; HukukBis is developed and run under those processes. You can see the product's technical controls on this page and in the service agreement.