İçeriğe geç
TRTürkçe
Sign In Sign Up
0 (850) 840 11 47 · Canlı Destek

KVKK · DATA PROCESSING AGREEMENT · DATA LOCATION

KVKK-compliant hosting and servers: frequently asked questions

We answered, one by one and based on our published agreements, the questions companies holding personal data ask before moving their servers. In short: for BurtiNET’s Istanbul services, servers and backups stay in Turkey, and this is committed in writing in the Data Processing Agreement.

Last updated: 13 November 2026

Short answers

  • Data and backup location Turkey (Istanbul, Mars Data Center, Tier-3)
  • Data Processing Agreement Published; no separate signature
  • Breach notification Within 48 hours of detection
  • Backups Encrypted, on separate backup servers
  • After the service ends Data and backups deleted within 40 days
  • VERBİS Registered

Data location, backups and DDoS

Are data and backups kept in Turkey at BurtiNET?

Yes. For BurtiNET’s Istanbul services (web hosting, VDS/VPS, business e-mail), servers, snapshots and backups are kept at Mars Data Center (Tier-3) in Istanbul. BurtiNET commits in writing, in the Data Processing Agreement (DPA) and the Backup Policy, that this data is stored in Turkey. Even if the data center changes, Istanbul services and their backups are not moved outside Turkey. If you choose a service located abroad (e.g. a server in Germany), your data is in that location.

How are backups taken, where are they and are they encrypted?

Backups of Istanbul services are kept encrypted on separate backup servers in the Istanbul data center; access to the encryption keys requires two approvals by BNET officers. Weekly backups are included free with VDS/VPS plans; web hosting plans have daily backups (JetBackup). Snapshots are not encrypted and are provided through a support ticket. No encryption commitment is given for server disks; you can encrypt sensitive data yourself at application or disk level.

Can we restore backups ourselves?

During the service, restores from backup are done by BurtiNET through a support ticket you open in the customer panel. You can also open a ticket for more frequent backups or snapshots. Restore requests are not accepted after the service has ended.

Does DDoS protection route traffic abroad? Is TLS decrypted?

Under normal conditions traffic is not routed abroad. Only during an attack is traffic coming from abroad cleaned on Voxility’s or StormWall’s infrastructure abroad; BurtiNET turns the filter off when the attack ends. These providers do not decrypt TLS traffic and do not see packet contents; they only log traffic coming from abroad. This does not mean the data or backups on your server are moved abroad. DDoS protection is free on every plan; the filtering cannot be turned off by the customer.

Data Processing Agreement and KVKK

Do you sign a data processor agreement under KVKK Art. 12?

BurtiNET’s Data Processing Agreement (DPA) is published on the site and takes effect automatically with the Terms of Service. The DPA requires no separate signature; no party-specific signed copy or additional protocol is issued. In the DPA, BurtiNET commits to measures in line with Article 12 of the KVKK and the Board’s technical and administrative measures: access restriction, encrypted backups, secure network infrastructure, access and incident logs, and staff confidentiality undertakings.

How quickly do you notify a data breach?

BurtiNET notifies a data security breach within 48 hours of detecting it, via the e-mail address registered on the account. This period is written in the Data Processing Agreement and the Privacy Policy.

How and when is our data deleted after the service ends?

When the service ends, server data and backups are deleted within 40 days at the latest; no restore is done after that and no deletion certificate is issued. You can export all of your data with your root/panel access before the service ends.

Can your staff access our server or backups?

BurtiNET staff do not access a customer’s server, disk or backups without the customer’s request. Access made on request is tracked with a support record. Legal obligations, decisions of competent authorities and responses to security or abuse incidents are exceptions.

Who are your sub-processors?

Main sub-processors: Mars Data Center (Turkey, data center) and Voxility and StormWall (abroad, DDoS filtering only during an attack). Services abroad used for our own website (e.g. Google, Microsoft Clarity, Cloudflare) are listed in the “Transfers Abroad” table of the KVKK notice.

Do you have ISO 27001?

Mars Data Center, where the services are provided, holds ISO 27001 and ISO 9001 certificates. These certificates belong to the data center operator.

Is BNET Bulut Bilişim registered with VERBİS?

Yes. BNET Bulut Bilişim Tic. Ltd. Şti. (BurtiNET) is registered with VERBİS, Turkey’s data controllers registry.

Do you notify us if a public authority asks for our data?

Yes. If a competent public authority requests access to your data, BurtiNET informs you unless legally prohibited.

What is your liability and SLA?

BurtiNET commits to 99.9% monthly network and server availability. If the target is missed, a service credit is given in the next period on request; the credit cannot exceed one month’s fee for the service. First-response targets: critical within 4 hours (24/7), high priority 8 hours, medium and low 24 hours. Details are in the SLA and the Terms of Service; we recommend keeping your own backups as well.

Technical questions

Virtualization, OS, root and IP on VDS/VPS?

VDS and VPS servers use KVM virtualization. Distributions such as Ubuntu 24.04 LTS, AlmaLinux, Rocky Linux and Debian can be installed; full root access and a static IPv4 address are provided. Plan upgrades are done in the customer panel.

Is port 587 open for outgoing e-mail?

Yes. Port 587 (authenticated SMTP) is open on every service, VDS/VPS servers and hosting plans included. Your application can send via SMTP through your business mailbox; the hourly sending limit depends on the plan, and a few hundred e-mails a month is far below it.

PHP version, cron and folders on hosting?

Hosting plans let you choose between several PHP versions with PHP Selector. Cron jobs can be set up; one account may run at most one cron job every 20 minutes.

If ModSecurity blocks a service’s requests, do you add an exception?

Yes. If legitimate requests from an external service (e.g. webhook/POST requests from AI services) are blocked by ModSecurity, an exception for a specific address or rule is added through a support ticket.

Is migration from DirectAdmin free?

Yes. We migrate your files, MySQL databases and e-mail accounts with their contents free of charge, including accounts coming from DirectAdmin.

Invoices, payment and prices

Company invoices, e-Fatura and bank transfer?

Yes. You can open the account in your company’s name and get invoices with the company title and tax number. If you are an e-Fatura taxpayer the invoice is issued as an e-Fatura via the Revenue Administration (GİB), otherwise as an e-Arşiv invoice. You can pay by credit card or bank transfer (havale/EFT).

Are prices in TL, is VAT included, what is the renewal price?

Prices are shown in TRY, USD or EUR and exclude VAT; VAT is added in the cart. Totals for monthly, yearly and other billing cycles are listed on every product card under “All billing cycles”. The price of a paid period does not change; the current price applies on renewal. Whether a campaign discount applies to the first invoice only or to renewals as well is stated in the campaign terms.

Documents these answers are based on

The binding text of these commitments is in the agreements below.

Your question is not here?

Write to kvkk@burtinet.com about KVKK and data security, or open a support ticket.

See VDS servers

Cookie Preferences

You choose everything except the necessary cookies. You can change your choice at any time from the Cookie Preferences link at the bottom of the page.

  • Necessary cookies Needed for your session, security and remembering your preferences. Always on