# Corex360 Security | CRM security, KVKK, access, backup > How Corex360 handles personal data under KVKK, role-based access with logs, backups and hosting on your own server. What is in place today and what is pending. Source: https://www.corex360.com/en/security Last updated: 2026-09-27 --- [Home](https://www.corex360.com/en) Security and hosting Corex360 Security # CRM security: tested against attack, built for defence. Corex360 Security is the security layer that protects the platform from both sides: regular penetration tests probe it from an attacker's point of view, and layered defence keeps every access on record. Whether your data sits on your own server or on Corex360 Cloud, the same security layer runs. [Request a demo](https://www.corex360.com/en/contact#form)Hosting options ✳ **Security feed** illustrative - **Sign-in from a new device** Accounting · logged - **Contract file downloaded** Sales · logged - **Permission changed** With manager approval - **Unusual access** Account owner notified Two directions ## From which two sides is Corex360 security built? Security is built from two sides. On one side are penetration tests that probe the platform regularly; on the other, the defence layer that runs under every record. The platform has been through a comprehensive penetration test, carried out in-house with Corex360 Security. On the defence side, permissions are [role-based](https://www.corex360.com/en/glossary/role-based-access-control); sign-ins, devices, and access are on record, files in Corex Drive are encrypted and tied to permissions, and encrypted backups are taken daily. Attack ### The platform is tested from the attacker side. - 01 **Penetration tests** The platform has been through a comprehensive penetration test, carried out in-house with Corex360 Security, which the Corex360 team developed. It is tested regularly from an attacker's point of view. - 02 **The outside view** The test looks at how the platform appears from outside: where would an attacker try to get in. Defence ### The same layer runs under every record. - 01 **Identity and access** Role-based permissions; every user sees only the records within their role, and a permission change needs manager approval. - 02 **Logging and alerts** Sign-ins, devices, and access are logged; an unusual event is reported to the account owner at once. - 03 **Files** In Corex Drive files are encrypted and tied to permission; sharing uses timed, revocable links. - 04 **Backups** Backups are encrypted and taken daily; if something goes wrong, records are restored from the latest daily backup. ## Which three layers run on the same record? Identity, files, and monitoring; all three run on the same core, not as a separate module. In the identity layer, access is role-based and a permission change is logged with manager approval. In Corex Drive, a file is encrypted and tied to its record and to permissions. In the monitoring layer, every access is on record, and an unusual event reaches the account owner. ### Identity and permissions Role-based access; permission changes approved by a manager and logged. ### Files and sharing In Corex Drive files are encrypted and tied to the record and permission. ### Monitoring and alerts Every access logged; an unusual event reaches the account owner. Hosting ## Where does your data live, and who chooses? You choose: Corex360 runs either on Corex360 Cloud, in a company-specific space on DigitalOcean infrastructure, or on your own infrastructure, where the server, disk, and network are under your control. The choice is written into the agreement. The same Corex360 Security layer runs in both; sign-in, device, and access records are kept the same way, and an unusual event is reported to the account owner. **Corex360 Cloud** A company-specific space on DigitalOcean infrastructure, written into the agreement. - **Same layer** The same Corex360 Security layer runs in both hosting options. - **Same trail** Sign-in, device, and access records are kept; an unusual event is reported to the account owner. **On your own server** Corex360 runs on your own infrastructure with the same security layer. - **Data stays with you** Server, disk and network under your control. - **Same trail** Sign-in, device, and access records are kept the same way. | Topic | Corex360 Cloud | On your own server | |---|---|---| | Where the data sits | A company-specific space on Corex360 Cloud, written into the agreement. | Corex360 runs on your own infrastructure. | | Security layer | The Corex360 Security layer | The same Corex360 Security layer | | Sign-in, device, and access records | Kept; an unusual event is reported to the account owner. | Kept the same way. | | Server, disk, and network | On Corex360 Cloud infrastructure | Under your control | ## What does KVKK (Turkey's data protection law) ask for in data processing? Personal data is processed under KVKK (Turkey's personal data protection law). The law asks for three things: telling people, putting the processing relationship in writing, and answering requests. The notice tells people which data is processed, for what purpose, and for how long. The [data processing agreement](https://www.corex360.com/en/glossary/data-processing-agreement) puts in writing on whose behalf, for what purpose, and under which safeguards data is processed. A person can in turn ask about their data and request that it be corrected or deleted. If you are outside Türkiye, your own country's data protection law also applies; Corex360 does not claim compliance with it. You choose where the data is kept: Corex360 Cloud or your own server. - 01 **Notice** People are told which data is processed, for what purpose, and for how long. - 02 **Data processing agreement** Puts in writing on whose behalf, for what purpose, and under which safeguards data is processed. - 03 **Data subject requests** A person can ask about their data and request that it be corrected or deleted. Open topics ## Which topics are left for the demo? Security details not yet written on the site are collected here: how penetration test findings are closed, where backups are kept and how recovery is tested, who holds setup and maintenance on your own server, the scope of the data processing agreement, export formats, encryption, the country of the Corex360 Cloud servers, and which provider a question goes to when X AI is used. In the demo call we go through them against your own setup. - **Penetration test** How findings are closed. - **Backups** Where backups are kept and how recovery is tested. - **Your own server** How setup and backups run on your side. - **Maintenance** Who holds maintenance and updates. - **KVKK** The scope of the data processing agreement and how requests are handled. - **Export** Export formats and handover when the contract ends. - **Encryption** How encryption covers data in transfer and in storage. - **Hosting country** Which country the Corex360 Cloud servers are in. - **AI** Which AI provider a question goes to when X AI is used. FAQ ## On security, what do people ask most? Security questions are mostly about where the data lives, who sees what, whether the platform is tested, what happens in an unusual event, KVKK, and handover of data when the agreement ends. The short answers: data lives where you chose in the agreement, permissions are role-based, the platform is tested regularly from an attacker's point of view, and an unusual event is reported to the account owner at once. ** 01 ### Where is my data hosted? ** Your choice: in a company-specific space on Corex360 Cloud or on your own server, written into the agreement. Corex360 Cloud servers run on DigitalOcean infrastructure. The same security layer runs in both. ** 02 ### Who can see what? ** Permissions are role based. Every user sees only the records within their role; a permission change needs manager approval and is logged. ** 03 ### Are penetration tests performed? ** Yes. The platform has been through a comprehensive penetration test, carried out in-house with Corex360 Security, which the Corex360 team developed. It is tested regularly from an attacker's point of view. How findings are closed is on the list of open topics. ** 04 ### How do I find out if something goes wrong? ** An unusual event is reported to the account owner at once; sign-ins, devices, and access are logged. ** 05 ### How is personal data handled under KVKK? ** Personal data is processed under KVKK (Turkey's personal data protection law). Access is role-based and every access is logged. The scope of the data processing agreement and how requests are handled appear among the open topics. ** 06 ### Can I export my data? ** Your data sits where the agreement says: in a company-specific space on Corex360 Cloud or on your own server. Export formats and handover when the contract ends are also on the list of open topics. Keep going ## Read more on this [On your own server Who on-premise setup suits and how it runs.](https://www.corex360.com/en/solutions/on-your-own-server)[KVKK: cloud or own server? How the two hosting options differ under KVKK.](https://www.corex360.com/en/blog/kvkk-cloud-vs-own-server)[Corex Drive Keeping files tied to the customer record and to permissions.](https://www.corex360.com/en/modules/corex-drive)[Drive and security questions Short answers on files, permissions, and hosting.](https://www.corex360.com/en/faq/drive-security) ## Sources - [Personal Data Protection Law (mevzuat.gov.tr)](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5) Last checked 25 September 2026 Resources ## Related pages [KVKK privacy notice The notice on how personal data is processed under KVKK, Turkey's data protection law.](https://www.corex360.com/en/data-protection)[Privacy What this site collects and how it is protected.](https://www.corex360.com/en/privacy)[Cookie policy The cookies used on this site and how to change your choice.](https://www.corex360.com/en/cookies)[Fact sheet Product facts with a stated source, on one page.](https://www.corex360.com/en/fact-sheet)