What we do
Design and implement software and infrastructure controls, prepare technical evidence and prepare your team for the technical part of audit interviews.
KVKK and ISO 27001
Build your software to meet KVKK and ISO 27001 expectations.
ALGOFACT helps software teams align the systems they build and run with Türkiye’s data protection law (KVKK, Law No. 6698) and ISO/IEC 27001:2022: a secure development lifecycle, access and logging design, a system-level personal data inventory and evidence preparation before an audit. Our own information security management system is ISO/IEC 27001:2022 certified. We are not a certification body or a law firm; legal advice comes from your own counsel.
When is this the right engagement?
This engagement fits when your company is preparing for ISO 27001 certification but the software team does not know what the auditor will ask, when a customer’s vendor security questionnaire asks where personal data is stored and the answer lives in a few people’s heads, or when a product that serves users in Türkiye was designed without KVKK in mind. The focus is the software itself rather than policy documents: code, infrastructure, access, logs and the development process.
International teams often meet KVKK when they enter the Turkish market or work with a Türkiye-based vendor. Many of its technical measures overlap with what the GDPR already asks for, but the details differ, for example on cross-border transfers and registration with the data controller registry (VERBİS). Your counsel decides what applies; we turn those decisions into working controls.
Accredited certification bodies issue ISO 27001 certificates, and interpreting KVKK obligations is your counsel’s job. We fill the technical gap between the two: we design how the controls an auditor or lawyer expects are implemented in software, build them and make them provable. Going through our own ISO/IEC 27001:2022 certification showed us firsthand where software teams struggle in an audit.
Areas of work
Each area produces an answer to a concrete question an auditor or a customer’s security team will ask.
- 01
Secure development lifecycle
Security and privacy items in requirements, threat modeling, code review rules, dependency and secret scanning, security testing and release approval, added to the tools you already use such as Git, CI/CD and your issue tracker. - 02
Access and permission design
Application and infrastructure level design for role-based access, least privilege, privileged account management, multi-factor authentication and revoking access when someone leaves. - 03
Logging and traceability
Application logs that record who accessed personal data, when and with which action; tamper-resistant log storage, retention periods and alerts on suspicious access. - 04
System-level data inventory
A technical inventory showing which personal data each application holds in which table, for what purpose and for how long, who it is shared with and whether it is transferred abroad. It feeds the records your legal team maintains. - 05
ISO 27001 audit preparation
Evidence collection for secure development, change management, backup, vulnerability management and supplier security controls, plus a work list for closing gaps before the audit.
How the engagement runs
- 01
Scope and current state
We define which applications, infrastructure and teams are in scope and review your existing policies, procedures and tools. - 02
Technical gap analysis
We compare the software-related controls in ISO/IEC 27001:2022 Annex A, and the technical measures your counsel has identified under KVKK or the GDPR, with the actual state of your codebase, infrastructure and processes. - 03
Prioritized work list
Findings are ranked by risk and effort, and each item gets an owner and acceptance criteria. - 04
Implementation
If you want, we make the fixes with your team: security checks in CI/CD, the access model, logging infrastructure, encryption and backup settings. - 05
Evidence and handover
For each control we prepare the evidence an auditor will see (configuration, log samples, records, procedures) and hand over training and runbooks so your team can keep the process running on its own.
What you receive
- 01
Gap analysis report
Control-by-control current state, findings and risk level. - 02
Secure SDLC definition
A process adapted to your team’s tools, code review rules and a release checklist. - 03
Access and logging design
Role and permission matrix, log schema, retention periods and alert rules. - 04
Technical data inventory
A personal data map at system, table and field level, with data flow diagrams. - 05
Audit evidence pack
Evidence mapped to controls and a record of closed findings.
What we do and what we do not do
ALGOFACT’s information security management system is ISO/IEC 27001:2022 certified, and the company holds the Kamu Bilişim Yetki Belgesi, which authorizes public-sector digital work in Türkiye. Among the use cases on /work, we built security infrastructure and hospital management system software for Özel Letoon Hastanesi, so we know how these controls work day to day in systems that process sensitive health data.
Certification
ISO/IEC 27001 certificates are issued by accredited certification bodies. We are not a certification body and we do not guarantee that you will be certified; the audit outcome belongs to the auditor.
Legal opinions
Privacy notices, explicit consent, VERBİS registration and cross-border transfers are legal questions for your counsel. We translate the requirements they set into technical design.
Policy writing
Writing your full set of information security policies is not the focus of this service. We contribute to technical procedures such as secure development, access, logging and change management.
Questions
Approach01Do you guarantee that we will get ISO 27001 certified?
No. Certification depends on the audit by an accredited certification body. We help you go into the audit prepared by making sure software and infrastructure controls are implemented and evidenced.
02Is our counsel not enough for KVKK compliance?
Your counsel determines the obligations and the measures required. A large share of those measures (access restrictions, logging, encryption, retention and deletion periods, a data inventory) has to be implemented in software. We work alongside your legal team and turn their decisions into code and infrastructure.
03We already comply with the GDPR. What changes for KVKK?
Much of the technical groundwork carries over, such as access control, logging and data minimization. Differences in areas like cross-border transfer rules and VERBİS registration are for your counsel to assess; we then update the data inventory, data flows and controls to match.
04Does this include penetration testing?
The focus of this service is process, design and evidence; penetration testing is a separate piece of work. The gap analysis helps you decide which security tests you need and how often.
05What drives the timeline and cost?
The number of applications and teams in scope, how well current processes are documented, the variety of personal data processed, the time left before your audit and whether we or your team make the fixes. The gap analysis can be scoped as a separate phase, and we plan the next steps in writing based on its findings.
Sources
- Personal Data Protection Law (Law No. 6698), Personal Data Protection Authority (KVKK)
- ISO/IEC 27001:2022 Information security management systems, International Organization for Standardization
Tell us about your project
Describe the problem briefly and we will reply with a time for a 30-minute discovery call.
Book a discovery call