Manage access to client data through permissions.
Vekilaw is developed by Vekilaw. Hosting location, service providers and transfer conditions require confirmation before service begins. Connector use depends on permissions and account setup.
- Session
- MFATwo-step verification and timed sessions
- Access
- ~85 permissionsDetailed, role-based permissions
- Data
- Per companyEach company's data is kept apart
- Documents
- Mandatory scanEvery file is scanned on upload
- Infrastructure
- Confirmation neededHosting location and service conditions require clarification
- Backup
- Conditions to be agreedBackup and recovery conditions require confirmation
Client data is protected in four layers
Access, application, data and infrastructure sit on top of one another; a request cannot return a result without passing through each of them.
The path of one request
Lawyer A opens the case list. Before any result comes back, the request passes four gates; if it stops at one, the list does not open.
09:12:00 The sign-in is verified
09:12:00 The sign-in is verified
- Layer 01/04 · Access
Signing in takes more than one password
Sign-in runs over an encrypted connection with a secure session. Two-step verification (MFA) adds a second step to the password, so a stolen password alone does not open the account.
Strong password rules apply and sessions stay open for a limited time. A suspicious session is revoked, and the access of a member removed from the firm closes immediately.
- Encrypted connection
- Two-step verification
- Strong password rules
- Immediate access removal
Secure access - Layer 02/04 · Application
Everyone sees only what the job requires
Detailed, role-based permissions decide who can do what across cases, clients, documents, billing, AI and integrations. You split the permissions into roles that fit your firm, and a user cannot grant anyone more than their own authority.
Owner protection stops a delegated permission from changing the owner's role. Search and dashboard cards depend on permissions too: a record you may not see stays out of results and dashboards. Important actions are written to the audit log.
- Layer 03/04 · Data
Each company's data is kept apart
Company-level isolation is the base of the architecture: every action is bound to the company identity of the session, and a record of another company can never enter a result. Integration keys and mobile device details are stored encrypted.
Every uploaded file goes through type, size and content checks, followed by a mandatory malware scan. A file that proves harmful or cannot be scanned is rejected. Documents past their retention period are handled by the rule you set.
Document securityGuide to legal document security and e-signature
- Layer 04/04 · Infrastructure
Infrastructure and data-processing conditions
Hosting location, service providers, capacity and redundancy require confirmation. Platform access uses an encrypted connection and failed sign-in attempts are limited.
Backup intervals, retention periods and recovery-test results require confirmation before service begins. Availability of 99.9% is a target; measurements and service conditions are agreed separately.
Vekilaw AI use depends on company setup and approval. Confirm the selected model service location, data transfers, retention and training-use conditions; the feature is unavailable until a model service is configured.
Illustrative infrastructure image
Compliance with Law No. 6698 is backed by data tools
This page does not provide evidence of a completed data-processing inventory or impact assessment for Vekilaw. Processing purposes, retention periods and service providers are clarified before service begins.
As the data controller, you are responsible for the privacy notice you give your own clients; we publish our own notice separately. The KVKK data tools make two jobs easier: data export and handling deletion requests. When a data subject asks for a copy of their data you export it, when a deletion request arrives you process the record, and retention periods follow the rule you set.
| Data | Data controller | Data processor |
|---|---|---|
| Client, case and document data | Your firm | Vekilaw (Vekilaw) |
| Account, subscription and invoice data | Vekilaw | Sub-processors (for example the payment provider) |
| Website form data | Vekilaw | Sub-processors |
Read the KVKK privacy noticeRead the privacy policyOpen the KVKK compliance guide
Review service providers and data scope
The rows below describe data scope for connection options. Active providers depend on account and service setup. Processing locations, possible transfers and retention conditions, including those of the AI model service, require confirmation.
- iyzico
- Online payment and collectionPayment amount and invoice reference
- Resend
- Outgoing emailRecipient address and message content
- SMS provider
- SMS notificationsRecipient number and message text
- Meta (WhatsApp)
- WhatsApp notificationsRecipient number and message text
- Mobile notification provider
- Mobile push notificationsDevice key and notification text
- Your calendar service (Google Calendar, Outlook)
- Calendar export; only to the calendar you connectTitle, time, place and description of hearings, deadlines and appointments
- E-document service to be selected
- E-document operations after provider selection, account setup and technical acceptanceInvoice and receipt content, tax details of the parties
- Network and security infrastructure (CDN) provider
- Traffic delivery and network security when configuredIP address and request information; processing location requires confirmation against provider conditions
- Error monitoring provider
- Technical error reports when configuredError type, request path and release information; masking controls apply and processing location requires confirmation
- Weather data provider
- Weather cardCompany location
- Image delivery provider
- Delivery of site imagesCarries no client data; public images only
Built and run with the assurance of Vekilaw
Vekilaw is developed and operated by Vekilaw. ISO/TSE certificate details have not been published.
We do not publish certification claims without verifying the certificate number, scope and validity.
- Information securityThe product provided by Vekilaw manages access through role, branch and case scope.
- Certificate statusVerified certificate details have not yet been published on this page.
- Product developmentVekilaw develops the product; operational conditions are clarified before service begins.
- Infrastructure conditionsHosting location and service providers require confirmation.
- 99.9% targetThe availability target is 99.9%; the measurement period and any contractual service-level terms are agreed separately.
- KVKKProcessing purposes, retention periods and provider scope require clarification.
- AI conditionsModel service, processing location, retention and training-use conditions require confirmation.
What do firms ask about security?
- 01/06
Where is my data hosted?
Hosting location and the services storing documents and backups require confirmation before service begins. Review operational conditions and service scope with this information.
- 02/06
How often are backups taken?
Backup intervals, retention periods and recovery-test results require confirmation before service begins. Use the product export operations to retrieve records within your permissions.
- 03/06
What happens to my data when I close my account?
Before closing, you can take your data with the export tool. Your deletion request is handled with the KVKK data tools, and records are deleted or anonymised under the retention rules.
- 04/06
What data does the AI receive, and does it leave Turkey?
AI use depends on company setup and approval. Prompts and selected text are processed by the configured model service. Processing location, possible transfers, retention and training-use conditions require confirmation. Quotas and periods depend on platform settings; outputs require lawyer review.
- 05/06
How can I report a security vulnerability?
Send it through the form on the contact page and write security report as the subject. We review the report and get back to you after verification.
- 06/06
Where can I find ISO/TSE certificate details?
Verified ISO/TSE certificate numbers, scope and validity for Vekilaw have not yet been published on this page. You can review the product’s access and data management features here.