Security and KVKK: Our Approach to Data Security
You decide who sees what; personal data is masked based on permissions, and every action is recorded.
-
Controlled Export
Personal data in Excel and CSV files is masked based on permissions; every download is written to the audit log.
-
Secure Login
Two-factor authentication and passkey support.
-
Role-Based Access
Users see only the units they are authorized for; personal data is unlocked with a separate permission.
-
Audit Log
Panel and API actions are kept in records that cannot be modified or deleted.
KVKK
Personal Data Processes on the Platform
The privacy notice, retention periods and data subject requests under KVKK (Turkish Personal Data Protection Law) are managed without the need for separate tools.
- Privacy Notice Prepared separately for each language and stored as versions. Which response saw which version is recorded.
- Retention and Masking Personal data whose retention period has expired is automatically masked or deleted every night.
- Data Subject Requests You respond to requests within the 30-day legal period; you find, export or delete the person's data.
- Permission-Based View Users without permission to view personal data see it masked.
Technical Measures
- All connections are encrypted with HTTPS (TLS).
- Passwords are stored as irreversible hashes (bcrypt); they are never kept as plain text anywhere.
- API keys are stored as hashes; the full key is shown only once, at the moment it is created.
- Webhook requests are signed with HMAC-SHA256; your system verifies that the request genuinely came from Comvo.
- Bulk invitation lists are stored encrypted and deleted after sending.
- AI analysis is optional and runs on Anthropic Claude; personal data is masked before it is sent.
Let us answer your security and KVKK questions.
We can address the questions of your information security and legal teams in detail during a demo call.