What we keep
| Data | Why | How long |
|---|---|---|
| Email, name, password hash | account and sign-in | while the account is open |
| Phone number (Türkiye) | SMS verification, important notifications | while the account is open |
| Identity details (Türkiye: ID number, name, surname, year of birth) | legal identity verification (Law No. 5651) | while the account is open; for the statutory retention period |
| Identity / company documents (files) | review by our team | the file is deleted 90 days after review; the review record remains |
| Payment details, documents, account activity | accounting and tax law | for the statutory retention period |
| Session records (IP, browser) | security | the session lifetime (30 days) |
| Audit log (who, what, when) | security and dispute resolution | for the statutory retention period |
| Support conversations | service | while the account is open |
Passwords are stored as hashes only; the two-factor secret is stored encrypted. The full API key is shown only at creation; the database keeps its hash.
Where the data is
Account data and documents are kept on dor.net's own systems. Parties that process data for specific tasks:
- Payments: card payments are collected through a licensed payment institution; your card details never reach dor.net.
- Official documents: the accounting integrator (legal name, address, tax details, document lines); details in Invoices, e-Invoice and PDF.
- Email and SMS: messaging providers for notifications and verification codes (address/number and message content).
- Identity check (Türkiye): identity details are verified through an official registry query.
Beyond these, your personal data is not shared with third parties; requests from competent authorities are fulfilled only where legally required and are recorded.
How your documents are stored
- Uploaded documents are not served from a public address; the file is reachable only through a path that checks authorization, by members of the organization that uploaded it and by the reviewing team.
- The file of an approved or rejected document is deleted automatically 90 days after review. Only the type, date and outcome remain.
- You can delete a pending or rejected document yourself.
You are responsible for server contents
- dor.net does not back up your servers' disks and does not access their contents. Backups, updates and security configuration are your responsibility.
- Reinstalling, deleting a server and cancelling a service wipe the disks irreversibly; disks of dedicated services cancelled for non-payment are wiped when the server returns to stock.
- For regular backups copy off the server (
rsync,restic,borgand the like) and test the restore. - You are the data controller for personal data you process on your servers; for your KVKK/GDPR obligations you can sign a data processing agreement with us if needed (support).
Your rights
To exercise your rights under Article 11 of the KVKK (access, correction, deletion, objection to processing), open a support ticket or write to hello@dor.net. Requests are answered within 30 days at the latest.
- Closing the account: after deleting your servers and bringing the balance to zero, open a closure request. Accounting records are kept for the statutory period; other data is deleted.
- Deleting documents: you can ask for reviewed documents to be deleted early without closing the account.
- Data portability: you can request an export of your account data.
Security recommendations
- Enable two-factor authentication.
- Everyone signs in with their own account; remove leavers from the team.
- Give API keys an expiry and revoke unused ones.
- Disable password login on the server and set up a firewall (first steps).