Where are our logs and customer data stored in a SOC service — do I need to ask from a KVKK standpoint?

Get log scrubbing done before it leaves your network. Have the agent or collector installed on your own server hash or star out email and identity data in the logs using SHA-256. Only scrubbed security telemetry should leave, eliminating the risk of data leaks.

Under Article 9 of KVKK, the transfer of personal data abroad is bound by strict rules. Unless standard contracts are drafted with your service provider and notified to the Board, storing data on foreign servers will result in administrative fines against your company as the data controller.

Add this exact sentence to the RFP: 'All log data and analytical outputs shall be stored in data centers within the borders of the Republic of Turkey.' Drop any provider who can't commit to this right from the start, or you'll have massive headaches later.

We faced the exact same dilemma. The provider quoted 120,000 TL more per year for the locally hosted solution in Turkey. We ran the numbers with our legal counsel; that price gap was negligible compared to the fines and brand damage from a potential data breach notification, so we went local.

Is the provider only collecting SIEM logs, or are they sniffing all packet traffic (PCAP) on the network too? If they're doing packet analysis, they could see all form data in HTTP traffic in clear text except credit cards—have you checked that?

Some vendors who claim 'our data center is in Turkey' only keep the database here and send the analytics to AI engines abroad. Unless you get it in writing as 'all systems, including data processing and analytics engines,' they'll find a loophole.

at our old company we had a system that sent logs to the us and during an audit the inspector caught a customers national id in a url inside a log file we barely survived writing justifications definitely get them maasked imo.

edit: fixed a few typos.

Ultimately, you have two paths: either implement strict masking on the log collector so personal data never leaves the premises, or sign with a locally hosted SOC model whose entire infrastructure is within Turkey.

im in the same situation thats why Im asking.. then tbh an automated scan report is not the same as a penetration test.

if you post the result here it will help others too.

Saved.

my perspective changed after experiencing that then like solutions that work at a small scale collapse when you grow; I learned this late.

paayment information changes are never verified through the channel they came from then if you post the result here it will help others too.

This thread is archived. Processes without records never improve, because you don't know what to fix.

The cheap-looking path usually ends up costing more later. If permission and scope aren't in writing, don't start that test.

When we decide without measuring, we always end up in the same place.

correct.

i'm a small business let me explain from my side and mistakes made on the where is soc data stored side are usually reversible but expensive.

I didn't know that.

noted thanks.

Generally correct, but one part is missing. If you don't write this down from the start, it leads to arguments later.

Proven by experience.