Security & privacy
Your data. Your priority.
Every customer gets a private tenant database with database-level isolation. Your data is hosted in your region (Turkey, EU, or US).
Tiered Deployment Architecture
Unlike most CRM providers that share one database across all customers, every Rapitek CRM customer gets a private tenant database — isolated at the database level, on Rapitek's managed infrastructure. That's stronger data isolation than the shared-table-with-row-level-filters model used by Salesforce, HubSpot and Zoho. Pick the tier that matches your compliance and scale needs.
Complete Data Isolation
No shared databases. Your data lives in your own private database, completely separated from everyone else.
Your Data Stays in Your Region
Servers are located in your region — Turkey, EU, or US — set at onboarding. Turkish-region hosting guarantees full KVKK compliance.
No Vendor Lock-in
Export your data anytime. Your data belongs to you, not to us.
Full API Access
Complete API access to your own data. Integrate with any system you need.
Security measures
Multiple layers of protection.
Encryption, backups, access control, and monitoring — your data stays safe at every layer.
TLS 1.3 in Transit · Credentials & 2FA Secrets Encrypted at Rest
Every connection to your CRM uses TLS 1.3 — the latest transport encryption standard, HTTP/2 enabled. Sensitive fields such as credentials and two-factor authentication secrets are encrypted at rest in the managed database layer. No legacy TLS 1.0/1.1 ciphers are offered.
Daily Automated Backups
Your data is automatically backed up every day. Multiple backup copies stored in separate locations for maximum safety.
DDoS Protection
Advanced DDoS protection ensures your CRM stays online and accessible even during attack attempts.
Role-Based Access Control
Define exactly who can see and do what. Granular permissions ensure each team member only accesses the data they need.
Two-Factor Authentication
Add an extra layer of security with 2FA. Even if a password is compromised, your account stays protected.
Audit Logs & Activity Tracking
Complete audit trail of every action. Know who did what, when, and from where. Essential for compliance and accountability.
KVKK
Turkish Personal Data Protection Law
KVKK Compliance
Rapitek CRM is fully compliant with KVKK (Turkish Personal Data Protection Law, No. 6698). We take your legal obligations seriously and provide the tools and infrastructure you need to stay compliant.
Because every customer has their own private tenant database, your data processing is inherently isolated. We include a data processing agreement (DPA) with every contract. Your users can exercise their KVKK rights — access, correction, deletion, and data portability — directly through the platform.
Infrastructure
Built on reliable cloud.
Your CRM runs smoothly on infrastructure designed for uptime, speed, and scale.
Managed Cloud Hosting
Managed multi-tenant cluster with per-customer resource guarantees.
Built for High Availability
Continuous health checks, zero-downtime deployments, and daily backups keep your CRM available so your team can work without interruption.
Automated Monitoring
24/7 automated monitoring detects and resolves issues before they affect you.
Disaster Recovery
Comprehensive disaster recovery plan with rapid restoration capabilities.
Compliance & controls
What's real in production today.
We're straight about this. KVKK/GDPR compliance and the access, login and audit controls below are live in production. We do not currently hold a SOC 2 or ISO 27001 certificate — and we won't claim one until we do.
KVKK & GDPR
ActiveKVKK and GDPR data-protection controls, production today. Data-processing agreement with every contract and data residency in your region — Turkey-resident hosting available for Turkish customers.
Enterprise Access Controls
ActiveSalesforce-parity model, production today: SSO/OIDC, Profiles, Permission Sets, a Role hierarchy, Field-Level Security, Org-Wide Defaults, Sharing Rules and Public Groups.
Login & Session Security
ActiveProduction today: IP allowlists, login-hour windows, two-factor authentication (email + TOTP), one active web and one mobile session per user, per-channel API access and an immutable audit trail with a Recycle Bin.
SOC 2 & ISO 27001
Not certifiedWe do not hold a SOC 2 or ISO 27001 certificate today, and we won't pretend otherwise. Our compliance posture rests on KVKK/GDPR and the live technical controls above. We're happy to share our security documentation with enterprise prospects on request.
Incidents are communicated directly to customer contacts, and you can request our current security documentation any time.
Security questions? Talk to us.
Our team answers every question about data security, KVKK compliance, and our tiered deployment model. Directly — no tickets.