Data security is the foundation of D-CAT projects and products. GDPR and KVKK (Turkish data protection law), enterprise security standards and the protection of personal data (PII) are part of that foundation.
We treat security not as a layer added later, but as the starting point of the architecture.
Depending on the deployment model, we work on-premises, in a private cloud, in a hybrid setup or in the cloud; your organization decides where data is processed. In Axoria Data Studio, the Privacy agent detects personal data fields before data reaches the model and transforms them while preserving their format, so the AI works with data whose statistical properties are preserved instead of real identity details.
Agent calls, model decisions and data access are logged. The question “Why did this result come out this way?” has a traceable, reproducible answer.
GDPR, KVKK and enterprise security policies are part of the design, and the architecture is updated as regulations change. Role-based access, row- and column-level authorization and encryption are at the core of our products.
Information security, process maturity and public sector qualification are certified by independent bodies.
Information security management system. Customer data, corporate assets and operational processes are subject to independent audit; it forms the basis of GDPR and KVKK compliance.
View the document (PDF)Software process maturity: an international maturity assessment of development processes, disciplined quality and repeatable delivery. A standard recognized in public tenders.
View the document (PDF)Issued by the Presidency of the Republic of Türkiye, it authorizes us to provide IT services to public institutions. It is the legal basis for D-CAT projects in government agencies, state-owned enterprises and municipalities.
View the document (PDF)We design regulation-compliant architectures for our customers in Türkiye and Europe.
KVKK, the Turkish Personal Data Protection Law, is the basis for enterprise data projects in Türkiye. D-CAT products are designed with an architecture that complies with it.
The Privacy agent in Axoria Data Studio detects personal data fields in the source database and transforms them while preserving their format: statistical properties are kept, and identity details never reach the model.
We build GDPR-compliant architectures for our Tallinn office in Estonia and for our international customers.
In regulated industries such as healthcare and finance, the industry's data sharing and privacy requirements are built into the project according to the deployment model.
Encryption, authorization, logging and backup are defined by the deployment model and set up in line with the customer's security policy.
Data is encrypted in transit and at rest; the method and key management are defined by the deployment model and your organization's policy.
Permissions are granted according to user roles.
Access and activity logs are kept audit-ready.
The architecture follows where the data and processing will run.
Connections are restricted according to your network policy.
The backup and disaster recovery plan is defined by the deployment model, together with your business continuity targets.
Three questions at a glance: where the application runs, what touches the data, and where the AI model sits.
Outside the frame. In the cloud or local. Only text goes out, never data; the model is fixed for each analysis.
App (end users) and console (administrators)
The agent runtime writes the narrative; the query engine calculates; FinalGuard checks at the gate
One official, versioned definition for every measure
Run and audit logs, roles, budgets
SQL and SSAS gateways, both read-only. No writes, no copies; your passwords never reach us.
Data warehouse (SQL) and SSAS cube. Data never leaves this environment.
Building queries, running queries, checking numbers, authorization decisions and spend control all stay outside the model.
When we build large language model and agent architectures, we give clear answers to three questions; AI use is always open to human oversight.
The data the model can access is limited by the deployment model; the connection runs on-premises, in a private cloud or in the cloud, and data sharing is logged.
Model outputs are explainable: the question “Why was this recommendation produced?” has an auditable answer.
Every AI call is monitored and reported: which agent, which model, how many tokens and at what cost.
We share data processing agreements, security protocols and audit documents on request.
Request detailed, product-specific security documentation.
Let's discuss our security architecture together at a technical level.
Personal data discovery in your enterprise database: an end-to-end compliance project covering detection, classification, masking and transformation.
Our team will get back to you about certificates, security documentation and deployment model options.
