Security and privacy (KVKK)

Data isolation

RotaMerkezi is a multi-tenant platform, and each organization's data is separated at the database layer with PostgreSQL row-level security (RLS); not even an application bug can let one organization see another organization's data.

Access and auditing

• Role-based permissions and unit / region-based data scope
• Two-step verification, corporate SSO and LDAP
• Immutable audit log for all critical operations
• Four-eyes principle for plan changes and vendor payments

Continuity

• Point-in-time recovery (PITR) with continuous WAL archiving, plus daily backups
• Weekly automated restore test (disaster recovery drill)
• Security headers, content security policy, rate limits

KVKK

• Personal data is processed only for the purpose of the shuttle service, in line with KVKK (Turkey's Personal Data Protection Law); location data is not collected outside trips
• Retention period and automatic anonymization for employees who have left
• Boarding data is not reported per person for punitive purposes; only as aggregate statistics

Protecting address and location data

Employee addresses are the most sensitive data in shuttle planning. In RotaMerkezi:

• In the employee list and detail screen, full addresses and exact coordinates are not shown for any role. District and province are visible only to authorized roles.
• A full address or exact location is revealed through a separate "show" request by an authorized user, and every view is written to the access log (who, whose, when, from which screen). This log cannot be altered or deleted.
• Address text is stored encrypted in the database.
• Employee density on the map is shown with k-anonymity: areas containing fewer than a set number of people are hidden or merged into larger areas, so no single person's home can be inferred from the map.
• Exported employee lists are marked with the downloader's name and date and are audited.

Permission model

A role determines what a user can do (e.g. plan lines, approve vendor payments). Data scope determines whose data they can work on (e.g. only the employees of one hospital or one region). Records outside the scope cannot be accessed even via a direct link. Vendor company representatives see only their own company's records.

Infrastructure security

• All traffic over HTTPS; security headers and a per-request content security policy (CSP)
• Rate limits on sign-in, the API and external integrations
• External addresses the server connects to cannot be redirected to the internal network (SSRF protection)
• Secret keys (API, SMS, map provider, etc.) are stored encrypted and never shown in plain text on any screen
• Automatic database backup before every deployment; version rollback

Frequently asked questions

Can one organization's data be seen by another organization?

No. Each organization's data is separated at the database level with row-level security. Even if there were a bug in the application layer, the database would not return another organization's rows.

Who can see employees' addresses?

By default, no screen shows full addresses. Only users granted full-address permission can view an address through a separate request, and that view is written to the access log.

Are employees' real-time locations tracked?

No. What is tracked is the location of the shuttle vehicle, and it is recorded only during the trip. Employees' registered addresses are used only for stop and line planning.

Is data backed up?

Yes. The database is continuously archived and can be restored to a specific point in time; daily backups are also taken. That backups can be restored is tested in a weekly automated drill.

What happens to the data of employees who leave?

When the retention period set by the organization expires, the personal data of employees who have left is automatically anonymized. Aggregate statistics are preserved.