Trust Center
Security & Trust Center
Your data is protected with enterprise-grade security
Trust
Standards and compliance
-
ISO 27001
alignedThe international standard for information security management. Masraff follows security practices aligned with ISO 27001.
-
KVKK
compliantFull compliance with Turkey's Personal Data Protection Law. Our data processing practices meet all KVKK requirements.
-
GDPR
compliantCompliance with EU General Data Protection Regulation. European customer data is protected to GDPR standards.
Security
Security Features
-
AES-256 Encryption
All data is encrypted both in transit (TLS 1.3) and at rest (AES-256). Receipt images and financial data are protected with the highest encryption standards.
-
Role-Based Access Control
Granular permissions ensure each user accesses only job-relevant data. Admin, approver, accountant, and employee roles are configured separately.
-
Audit Trail
Every action is logged with timestamp, user info, and IP address. Immutable audit logs are ready for internal and external audits.
-
Two-Factor Authentication
Enhance account security with 2FA support. TOTP, SMS, and email verification options available.
-
SSO Integration
Integrate with your enterprise identity providers (Azure AD, Okta, Google Workspace) via SAML 2.0 and OAuth 2.0.
-
Backup & Recovery
Automatic daily backups with instant recovery capabilities. Geo-distributed backup infrastructure reduces data loss risk to zero.
Data
Data Protection
-
Data Retention & Deletion
Your data is securely stored throughout the contract period. Upon account closure, data is permanently deleted within 90 days. Full compliance with KVKK and GDPR right to erasure.
-
Data Residency
Customer data is hosted in data centers in Turkey and the EU region. Regional data residency requirements are met.
-
Data Processing Agreement
A KVKK/GDPR-compliant data processing agreement is signed with every enterprise customer. Processing purpose, duration, and security measures are clearly defined.
-
Third-Party Security
Our sub-processors undergo regular security assessments. All integration partners must meet our minimum security standards.
Compliance
Compliance
- Turkey
KVKK
Full compliance under Turkey's Personal Data Protection Law. Consent management, data inventory, and VERBİS registration.
- European Union
GDPR
Data processing practices and user rights management meeting EU General Data Protection Regulation requirements.
- Turkey
e-Invoice / e-Archive
Integration with Turkey's Revenue Administration (GİB) for e-invoice and e-archive invoice compliance.
- Global
Tax Regulation
VAT/GST processing and reporting compliant with Turkey, EU, and Middle East tax regulations.
FAQ
Frequently Asked Questions
How does Masraff protect my data?
Masraff protects your data with AES-256 encryption, TLS 1.3 secure transport, role-based access control, two-factor authentication, and immutable audit logs. Our infrastructure follows security practices aligned with ISO 27001 and undergoes regular security audits.
Is Masraff KVKK and GDPR compliant?
Yes. Masraff fully meets KVKK and GDPR requirements. Data processing agreements, consent management, right to erasure, and data portability features are provided as standard.
What audit reports do you provide?
Masraff provides complete audit trail logs, policy compliance reports, approval history, document verification records, and customizable audit reports. All reports can be exported via Excel, PDF, and API.
What happens in case of a data breach?
Masraff's incident response plan meets KVKK and GDPR requirements. In the event of a data breach, affected parties are notified within 72 hours, impacted data is identified, and corrective actions are implemented.