Legal Finance & Operations Platform
Permissions on the server, data apart, trail immutable
A security claim should be verifiable. What follows are controls implemented in code and covered by automated tests.
Tenant isolation
Which firm’s data is accessed is never read from a client-supplied parameter; it is determined from the session. All data access is bounded by firm identity, so even if an endpoint skipped the check the data layer would not return another firm's rows.
- guvenlik.tenant_izolasyonWorking
Role-based access
Roles, office scope and per-user exceptions. The permission required by each endpoint is declared in one table; an endpoint missing from that table is closed. Adding an endpoint without declaring its permission does not leave it exposed.
- guvenlik.rbacWorking
Two-factor authentication
TOTP and single-use recovery codes. The platform administration console requires the second factor in all cases.
- guvenlik.mfaWorking
Client-money controls
An operation that would push a trust account negative is rejected on the server. Withdrawal from trust requires its own permission and is written to the audit trail.
- emanet.ayrimWorking
Audit trail
Sign-in, permission changes, financial records, approval decisions and AI access are kept in separate trails. The AI trail records which tool reached how many records under which scope.
- guvenlik.denetim_iziWorking
Backup and restore
Scheduled backups, integrity digests and a restore procedure. A restore drill has been performed and its output is recorded in the repository.
- guvenlik.yedekWorking
What has not been done yet
An independent penetration test has NOT yet been carried out. Internal security tests are not a substitute for independent review. No ISO 27001, SOC 2 or similar certification has been obtained; the documents in the repository are readiness material. This page makes no claim of certification.
Manage finance, accounting and operations on a single AI-assisted platform.
Every capability on this page is labelled with its real status. Features that require an external provider do not work without an agreement, and are not presented here as if they did.