Last updated: 16 October 2026
Your Data
This page only describes safeguards that work in the product today. Where we do not do something, or where data is processed outside Türkiye, we say so plainly.
In short
- The application, the database and the files you upload live on our server in Türkiye.
- Each building sees only its own records; within a building, everyone sees only what their role allows.
- Who changed what and when is written to an audit log that cannot be deleted from the application.
- Backups are taken every night; an encrypted copy is stored in the European Union.
- You can download all your data at any time as a single ZIP with Excel files and documents.
- We do not sell your data or use it for advertising or marketing.
Where is your data?
The application, the database and your uploaded documents run on our server in Türkiye. The database is closed to the outside network and only the application server can reach it. The server accepts key-based logins only; password login is disabled.
The connection between your browser or the mobile app and us is always encrypted (HTTPS). Your browser is told to use only encrypted connections to this address for one year (HSTS).
Fonts are served from our own server; no map, advertising or tracking service runs in the panel.
Buildings are kept apart
Every record belongs to one building. When you sign in, the building you are working in is written into your session key, and a “this building only” condition is added automatically to every database query. New records are always saved to the open building.
Uploaded files are stored in per-building folders and cannot be opened by a direct address; every download goes through the application, which checks your permission and that the record belongs to you.
Who sees what?
You give everyone on the management team a role: Building Manager, Board Member, Accounting, Auditor (read-only), Communications, Security/Concierge, Technical Staff or Lawyer. For each role you choose which sections can be viewed and which can be changed, and you can limit a person to certain blocks. A lawyer sees only the units assigned to them, until the end date you set.
Residents see only the dues, payments and requests of their own units.
- Passwords are stored in a non-reversible form (PBKDF2 hash); nobody, including us, can see your password.
- After 5 failed sign-ins in a row the account is locked for 15 minutes.
- Two-step verification (authenticator app and recovery codes) is available to everyone; you can make it mandatory for the management team.
- You can see your open sessions device by device and close any of them. Resetting a password closes all sessions; changing a person’s permissions closes their session too.
- The session cookie cannot be read by scripts in the browser and is not sent with requests coming from other sites.
Audit log
Every creation, change, deletion and export on records such as charges, payments, expenses, people and settings is written to the audit log with who did it, when, and the old and new values of the changed fields. The log cannot be edited or deleted in the application and is kept for 10 years.
Personal fields such as ID number, phone, e-mail, IBAN, year of birth and licence plate are masked in the audit log; passwords and two-step verification data are never written.
If our team needs to enter your building for support, that session is limited to 30 minutes and every action appears in the audit log with a “support” label.
A closed period can only be reopened with a written reason; who reopened it, when and why stays on record.
Encrypted fields
On top of the encrypted connection, some fields are also encrypted in the database: people’s ID numbers, staff ID numbers and IBANs, the passwords of your SMS and messaging accounts, and two-step verification keys. Other fields such as name, phone and e-mail are not encrypted in the database; the access rules above protect them.
Backups
The database and uploaded files are backed up every night, and each backup is automatically checked to be readable. Backups from the last 7 days and the last 4 weeks are kept on the server.
In case something happens to the server, a copy of the backup is also sent to the Cloudflare R2 storage service on servers in the European Union. The copy is encrypted before it leaves, with a key that we hold; Cloudflare cannot see the contents. Restoring from backup has been tested on a database separate from the live system.
Your data is yours
A fully authorised manager can download all of the building’s records in Excel and all uploaded documents in folders as a single ZIP file at any time. Every list can also be exported to Excel. If you leave, your data is not locked in with us.
Residents download a copy of the data held about them from the “My data” page, and send correction, deletion or objection requests from the same page. Requests are answered within 30 days at the latest.
How long is data kept?
Data that is no longer needed is deleted automatically. The periods below are the defaults; building management can change the file retention periods in its own settings. Charges, payments, receipts, the decision book and meeting records are not deleted because of building management’s legal retention obligations.
| Data | Period |
|---|---|
| IP address and browser of sessions, sign-in records | 90 days |
| Ended sessions | 30 days |
| Delivery records of sent SMS, e-mails and notifications | 1 year |
| In-app notifications | 1 year |
| Gate entry records (visitors, parcels) | 1 year |
| Fault and meter photos | 12 months |
| Receipts of rejected payment notices | 30 days |
| Deleted files (permanent removal from disk) | after 30 days |
| Audit log | 10 years |
| Enquiry forms on the website | 2 years |
Service providers we use
We use outside services for some tasks. Each receives only the data that task needs:
- SMS, WhatsApp and Telegram messages go through the account connected by building management; the building chooses that provider.
- No analytics, advertising or social media service runs in the panel.
| Provider | Purpose | Data sent | Location |
|---|---|---|---|
| Resend | Sending e-mail | Recipient’s e-mail address and name, message content | EU (Ireland) |
| Cloudflare R2 | Encrypted copy of backups | Encrypted backup file (contents unreadable) | EU |
| Cloudflare Turnstile | Bot protection on sign-in and forms | Verification token and IP address | Global |
| Sentry | Monitoring application errors | Error details; name, e-mail, IP, IBAN and cookies are stripped before sending | EU (Germany) |
| Google Firebase | Mobile app notifications | Device token and notification text | Global |
| Google Analytics | Visit statistics on the website only, with your consent | Browser and page information | EU and USA |
Roles under data protection law (KVKK)
For the owner, tenant and staff records of your building, building management is the data controller; Açık Defter is the data processor and handles this data only on building management’s instructions, to provide the service. For manager accounts, subscriptions and website forms, Açık Defter is the data controller.
A resident’s data request goes to building management; before applying a deletion, management sees a preview of which data will be deleted and which must stay for legal reasons.
Cookies in the panel
panel.acikdefter.com uses only the essential cookies needed to keep you signed in; the mobile app uses no cookies and keeps the session in the phone’s secure storage.
| Cookie | Purpose | Duration |
|---|---|---|
by_session | Session key. Cannot be read by scripts, sent only over encrypted connections and only from this site. | Until the browser closes; 30 days if “Remember me” is ticked |
by_auth | Tells the interface that a session is open; contains no personal data. | Same as the session |
by_origin | Only during a support sign-in, so the manager can return to their own session afterwards. | Until the browser closes |
Questions: info@acikdefter.com