Regulation and compliance
In Türkiye, log retention is not just good security practice — it is a legal obligation. This page explains which regulation affects you and how SYSLOG satisfies each one.
The Turkish Internet Law
In force since 2007, Law No. 5651 and its regulations define who provides internet access, which records they must keep, for how long, and in what form.
Who is in scope?
- Access providers — ISPs and WISPs; subscriber access records
- Mass-use providers — hotels, cafés, malls, dormitories, hospitals, schools, offices… anyone offering internet to customers, guests or staff
- Hosting providers — traffic records of hosted services
Core obligations
- Keep access records Internal IP, external IP, port, destination and time (including NAT logs).
- Seal with timestamps Accuracy and integrity must be provable with qualified timestamps.
- Retain for at least 2 years Regulations define retention windows per role.
- Produce on request Records must be deliverable to judicial authorities in verifiable form.
End-to-end automation
Firewall/hotspot records are collected automatically, daily files are digested with SHA-256 and sealed with RFC 3161 timestamps, then retained 2+ years. Date-IP queries for lawful requests are reported within minutes.
E-Signatures and Qualified Timestamps
The "provably accurate record" that Law 5651 demands is delivered through the qualified timestamp defined by E-Signature Law No. 5070. Stamps are issued by Electronic Certificate Service Providers (ECSP) authorized by the Turkish regulator (BTK).
- Digest A SHA-256 digest of the day's log files is computed — the files themselves never leave.
- Request The digest is sent to the provider's timestamping server via RFC 3161.
- Sealed response The provider signs the digest together with the current time: a TimeStampToken.
- Archive & verify The token is stored with the logs and verified in one step during audits.
Data protection and security standards
KVKK / GDPR — Personal Data Protection
Logs contain IP addresses, usernames and behavioral data, so you are processing personal data. SYSLOG supports you with:
- Role-based access — only authorized staff see logs containing personal data
- Masking — partial hiding of sensitive fields in views
- Retention/disposal policy — automatic, logged destruction of expired records
- Audit trail — "who looked at the logs?" is itself logged
ISO/IEC 27001 — Information Security
Log management controls are directly audited in 27001:2022 certification:
| Control | Requirement | SYSLOG |
|---|---|---|
| A.8.15 | Logging | ✓ Centralized collection |
| A.8.16 | Monitoring activities | ✓ Real-time monitoring + alerts |
| A.8.17 | Clock synchronization | ✓ NTP + qualified stamps |
| A.5.28 | Evidence collection | ✓ Integrity-proof archive |
Pre-audit checklist
If any answer is "no", we should talk.
1. Is every source centralized?
Do all firewalls, hotspots, servers and network devices forward to a central log server? A log left on the device counts as no log.
2. Are records stamped?
Are your log files sealed with qualified timestamps? An unstamped record cannot be legally presumed unaltered.
3. Would you notice a gap?
How many minutes until you know a device stopped logging? Auditors question the gaps.
4. Can you answer fast?
Can you produce a signed report answering "who used this IP at that time?" within minutes?
Let's assess your compliance posture
A free assessment call maps your current setup and reports the gaps.
Request a Free Assessment