Seratus
TRRequest a demo

Case file · prepared for the data controller and management

Know whereyour datalives.Prove whatyou did about it.

Personal data under KVKK and GDPR, special-category data, trade secrets, competition-sensitive information. Seratus finds it without agents, shows who can reach it, and records every action as evidence.

Request a demo See how it works
Open case file with a highlighted line and an olive stamp impression
Fig. 1 · DOSSIER 001

§ 1

Findings of fact

Findings of fact

The following was established at the organizations Seratus is built for.

  1. 1.1

    Personal data, special-category data, trade secrets and competition-sensitive information sit on file servers, in relational databases and in connected systems. Their location is not known with certainty.

  2. 1.2

    Who can reach that data, and how far it is shared beyond need, is not visible to the people accountable for it.

  3. 1.3

    KVKK inventory, data subject requests and disposal are carried out by hand, and leave no evidence that would satisfy an audit.

  4. 1.4

    Installing software on every endpoint to find out is not acceptable to the organization.

Built for

Information security, compliance and data controller teams at mid-size and large organizations with KVKK obligations. Teams whose personal data sits on file servers, in databases and in connected systems, and who need to know where it is, who reaches it and how risky it is, with inventory, requests and disposal no longer run by hand and without evidence.

§ 2

The procedure

How it works

Seratus operates as one procedure. Each step produces a record.

StepActionRecord produced
01DefineDecide what to look for: data categories, scope, sources and rules.Scope definition
02ScanSources are scanned remotely, without agents on endpoints.Scan report per source
03ReviewFindings are examined with their context, access and exposure.Classified finding with context
04RemediateRisky items start an action, assigned to an owner and submitted for approval.Assigned action, approval decision
05ProveResults are documented in reports and KVKK screens, backed by the audit log.Audit entry: who, when, why

§ 3

Exhibits

Capabilities

Capabilities, entered as exhibits.

Seratus console: KVKK readiness score, risk score by category and the five actions that reduce risk most
Fig. 4 · Seratus console: KVKK readiness score, risk score by category and the five actions that reduce risk most
Exhibit A01/08

Agentless discovery and classification

File shares, local disks on Windows, Linux and macOS, relational databases and connected systems are scanned remotely. A tiered, Turkish-specific detection engine separates personal data, special-category data, trade secrets and competition-sensitive information by context.

Discovery targets with connection state
Fig. 6 · Discovery targets with connection state
Exhibit B02/08

Data security posture and access graph

Where data lives, who can reach it and how far it is exposed through oversharing, shown as a graph and ranked by risk.

Who can reach objects containing national ID numbers: object count, subjects with permission, anonymous access
Fig. 5 · Who can reach objects containing national ID numbers: object count, subjects with permission, anonymous access
Exhibit C03/08

Remediation workflow

Masking, quarantine, deletion and disposal are assigned to an owner, each with separate approval authority. Every step is written to the audit log.

A remediation job awaiting second approval
Fig. 7 · A remediation job awaiting second approval
Exhibit D04/08

KVKK compliance suite

VERBİS inventory, data subject requests (DSAR), consents, and disposal or anonymization with a redacted copy, destruction of the original and quality measured through uniqueness checks.

  1. Received·
  2. Located in 4 sources·
  3. Redacted copy produced·
  4. Original disposed·
  5. Evidence attached✓
KVKK gaps ranked by severity
Fig. 8 · KVKK gaps ranked by severity
Exhibit E05/08

Competition compliance module

Helps organizations identify competition-authority risk in their data and take preventive measures within the same console.

Exhibit F06/08

Optional private LLM enrichment

Enrich tasks such as request summaries with a model running on your own infrastructure. Compatible with air-gapped deployment and bound by a data-minimization agreement.

Exhibit G07/08

Integrations

Send findings and actions to SIEM and ticketing systems. Synchronize users and scope through your directory (LDAP).

Exhibit H08/08

Deployment and administration

On-premises installation, signed packages and updates, role-based access control, Turkish and English interface.

Appendix A · Integrations

→
  1. Find and protect personal data in Microsoft 365A1
  2. Make personal data on file shares visibleA2
  3. Discover personal data in your Oracle databaseA3
  4. Find personal data in SQL ServerA4
  5. See personal data in your open-source databasesA5
  6. Discover personal data in object storageA6
  7. See personal data in email archivesA7

Appendix B · Features

→
  1. Agentless data discovery (DSPM)B1
  2. Data classificationB2
  3. KVKK complianceB3
  4. Access and exposure graphB4
  5. Remediation and evidenceB5
  6. Private, on-premises LLM enrichmentB6
  7. Turkish-specific detection accuracyB7

Planned integrations · planned  ·  FAQ

§ 4

Conditions of installation

Deployed where your data already is

Seratus runs inside your organization. Nothing is sent out to be analyzed.

  • 4.1 On-premises

    Installed on your own servers, including fully air-gapped networks.

  • 4.2 Signed packages

    Installation and updates ship as signed packages you can verify.

  • 4.3 Role-based access

    Separate roles for scanning, review, approval and administration.

  • 4.4 Turkish and English

    Full interface in both languages.

§ 5

Statement

Not “we did it.”

“Here is the proof.”

Every scan, every decision and every disposal in Seratus ends in an audit record a regulator can read. That is the product.

  • 5.1Agentless by default. Scan file shares, relational databases and connected systems remotely. No software on endpoints, no rollout project before you see results.
  • 5.2Built for Turkish accuracy. A tiered detection engine developed specifically for Turkish distinguishes personal data, special-category data and business secrets in context. Every rule carries its own accuracy and false-positive reduction program.
  • 5.3Evidence, not claims. Every action passes through approval and lands in the audit log: who, when and why. Not "we did it" but "here is the proof".
  • 5.4Air-gapped and on-premises. Data never leaves your organization. Runs fully offline, with an optional private LLM hosted on your own infrastructure.
  • 5.5KVKK end to end. From discovery to disposal and data subject requests, one continuous workflow in a single console.
Rubber stamp lifted from paper beside a signature
Fig. 3

Signed on behalf of Seratus

Seratus · Opened 2026

§ 6

Request

See Seratus on your own data

Request a demonstration on your own data. We will walk through discovery, risk ranking, remediation and the KVKK screens with your scenarios.

Request a demo[email protected]
Organization
 
Role
 
Preferred date