What security measures does Sora İK apply?
Sora İK applies encrypted connections, hashed passwords, role-based permissions and an audit log together. This page contains only verifiable architectural facts; the table below shows the measures at a glance.
| Area | Implementation |
|---|---|
| Encryption in transit | TLS 1.2 or higher; TLS 1.3 where supported |
| Encryption at rest | — |
| Password storage | One-way hashing with argon2id; passwords are not stored in plain text |
| Session | Short-lived access token; cookies flagged httpOnly and Secure |
| Access | Role-based permissions; two-factor authentication (2FA) |
| Activity log | Audit log for critical operations |
| System logs | Personal data is kept to a minimum: email addresses are masked, and the login log keeps only the network prefix of the IP address |
| Server location | (to be confirmed) |
| Backups | (to be confirmed) |
How is data encrypted in transit?
All traffic between your browser and Sora İK servers is encrypted with TLS 1.2 or higher, and with TLS 1.3 where supported. Unencrypted HTTP requests are redirected to the HTTPS address, and the HSTS (HTTP Strict Transport Security) header tells browsers to use encrypted connections only.
How are passwords stored?
Passwords are never stored in plain text; they are kept as one-way hashes using the argon2id algorithm. A new password must be at least 10 characters long, and commonly used passwords are not accepted. Login and password reset attempts are protected by rate limiting, and the responses on these screens do not reveal whether an email address is registered in the system.
Who can access which employee data?
Access depends on the role assigned to the user: with the Roles, Permissions & Security module, which user can view and change which employee data is defined per role. Special category documents require a separate permission. Employees' names, departments, positions and managers, however, are visible on the org chart to users in the default roles. The Roles, Permissions & Security module also covers two-factor authentication; the company owner can make two-factor authentication mandatory company-wide.
Are actions recorded?
Yes. Critical operations such as account approval, plan assignment and permission changes are written to the audit log, together with the user who performed them, the operation type, the affected record and the time. When records are changed in the application, the names of the changed fields are also logged; views of pay, payroll, candidate and performance records, the display of national ID numbers on the employee card and document downloads are recorded in the audit log as well. Keeping the previous and new values of a changed field is coming soon. In system logs, by contrast, personal data is kept to a minimum: email addresses are masked, and the login log keeps only the network prefix of the IP address.
How are roles allocated under KVKK?
For employee data in Sora İK, the customer company is the data controller and Sora İK is the data processor. Sora İK processes this data only to provide the service and in line with the customer's instructions; the parties' obligations are set out in the Data Processing Agreement. For website visitors, form submitters and account administrators, Sora Yazılım Teknolojileri is the data controller; details are in the KVKK Privacy Notice.
| Data | Data controller | Data processor |
|---|---|---|
| The customer company's employee data (employee records, leave, attendance ledger, payroll, etc.) | Customer company | Sora İK (Sora Yazılım Teknolojileri) |
| Data of site visitors, form submitters and account administrators | Sora Yazılım Teknolojileri | The service providers listed below (acting directly as data processors for this data) |
Using Sora İK does not remove the data controller's KVKK obligations. Today, role-based permissions, a separate permission for special category documents and logging of sensitive data views contribute to meeting these obligations; the KVKK Compliance Management module, which will record the personal data inventory, retention periods and data subject requests, is coming soon.
Which sub-processors does Sora İK work with?
Sora İK uses the following sub-processors to provide the service. The same list also appears in the data processing agreement.
| Sub-processor | Purpose | Location |
|---|---|---|
| (to be confirmed) | Hosting the application, database and backups | (to be confirmed) |
| (to be confirmed) | Sending account verification, password reset and notification emails | (to be confirmed) |
| Cloudflare | Domain management (DNS) and distribution of media files (media.sora-ik.com) | Outside Türkiye (global network) |
| Cloudflare R2 | Storage of employee document files and database backups | Europe (Eastern Europe, EEUR location hint; the EU jurisdiction option is not used) |
| Cloudflare Turnstile | Blocking automated (bot) form submissions | Outside Türkiye (global network) |
Information on transfers outside Türkiye is provided in the KVKK Privacy Notice. Analytics tools run only on the website and only with your cookie consent; details are in the Cookie Policy.
How are the website and forms protected?
Public forms on the site (contact, demo, KVKK request and company registration) are protected by Cloudflare Turnstile verification and per-IP rate limiting, and all input is validated on the server. State-changing requests that signed-in users make with their session cookie are additionally protected against CSRF (cross-site request forgery). The site is served with security headers such as a content security policy (CSP) and HSTS.
Can you export your data?
Yes. You own the data you enter in Sora İK; during the subscription and when it ends, you can export your attendance ledger and payroll data, your reports (including the leave summary report) and the audit log in CSV format. CSV export of the employee list is coming soon. After the agreement ends, the data is deleted within the period specified in the sales and subscription agreement.
For security questions, you can use the contact form; a separate KVKK request page is available for requests under KVKK.