How we protect your company data
Birasyo runs on Microsoft Azure. The ISO 27001 and SOC 2 Type II certifications of the infrastructure are held by Microsoft Azure. The questions you ask the AI are not used to train models.
Microsoft Azure infrastructure
Birasyo is hosted in Microsoft Azure's data centre in the Netherlands (West Europe). Microsoft does not currently have an active Azure region in Türkiye. For customers whose data must stay in Türkiye, a private deployment can be set up in a data centre in Türkiye. The ISO 27001, ISO 27018, SOC 2 Type II, PCI DSS and HIPAA certifications belong to the cloud platform we run on.
Data encryption
Traffic is encrypted with TLS 1.3 and stored data with AES-256. Sensitive fields (national ID number, IBAN, SGK records) are additionally encrypted at column level. Encryption keys are kept in Azure Key Vault. The database and the files are encrypted with separate keys, so access to one key does not open the other.
KVKK and GDPR compliance
The privacy notice, explicit consent management, the data subject request form, and deletion and anonymisation come ready in the product. Our customers can also record all the data in their own company with the KVKK inventory module. With customers in the EU we sign a Data Processing Agreement (DPA), as GDPR requires.
AI and privacy
Birasyo AI uses Anthropic's Claude models through Anthropic's API. Your question and the records needed to answer it are processed on Anthropic's servers outside Türkiye. Under Anthropic's commercial terms, this data is not used to train models. The assistant only looks at your own company's records. Which company's data it can see is set by your session, and the model cannot change that.
Backup and disaster recovery
Database transaction logs are backed up continuously, so we can restore to any point in the last 35 days. A full backup is also taken every night and kept for 90 days. Restoring from backup is tested automatically every week and the result is compared with the live database. When a restore is needed, it is started within 4 hours.
Access control and audit
Role-based access control (RBAC) applies in every module. Two-step verification with an authenticator app (TOTP) and single sign-on (OIDC and SAML 2.0, including Microsoft Entra ID) are supported. Every data change is written to an audit log that cannot be altered afterwards: who changed which field, when and from which IP. Suspicious sign-ins trigger an immediate alert.
Where your data is kept
You choose where your data is kept: Microsoft Azure West Europe, Netherlands (the default) or a private cloud deployment set up for you in a data centre in Türkiye. Microsoft has no active Azure region in Türkiye. The location you choose is written into the data processing annex (DPA) of your contract.
Incident management
The system is monitored continuously, and error and performance records are collected automatically. If a data breach is detected, the customer is notified by e-mail and phone within 24 hours. The information needed for KVKK's 72-hour notification to the Board is prepared within that window, and a detailed incident report is delivered within 7 days. These timelines are written into the Data Processing Agreement.
Infrastructure certifications and compliance
The infrastructure and AI certifications belong to the providers we use. We meet our KVKK and GDPR obligations through our own processes.
Request a security report or DPA
For review by your board or legal team, you can ask for the security architecture summary, Azure's SOC 2 summaries and a sample Data Processing Agreement (DPA).