Skip to content

Data Processing Agreement#

According to the Hitchhiker's Guide to the Galaxy, a towel is the most useful thing an interstellar traveller can carry. In the world of KVKK, Türkiye's personal data protection law, that towel is a data processing agreement: if your server holds personal data, it is the document you want in hand when an auditor knocks. The Data Processing Agreement (VİS) puts in writing that VeriTeknik processes the data on your server only on your instructions and in line with KVKK Article 12. It is prepared in the portal, signed in the portal and downloaded as a PDF.

Who can use it?#

  • Companies in Türkiye. The agreement is written under KVKK and is available to companies in Türkiye only.
  • Server services. Virtual servers (VPS), dedicated servers and managed servers, prepared as a separate annex for each service type.
  • Customers with a signed main contract. The agreement is an annex to your service contract, so it cannot be signed before the main contract.

Where to find it#

Open the contract on the My Contracts page. The Data Processing Agreement section sits below the contract's documents and amendments. If there is no annex yet, press Create Data Processing Agreement next to the service type.

Signing, step by step#

  1. Complete your company details. If the card says Missing company details, fill in the listed fields through Complete company details. The agreement names your legal name, address, tax office, tax number, signatory and contact person.
  2. Complete the form. Complete form opens a form where you state:
    • Your role: do you process the personal data on the server on your own behalf (data controller) or on behalf of your own customers (data processor)?
    • Processing description and data subjects (employees, customers, site visitors and so on).
    • Data categories: a name and the data items for each category.
    • Special categories of personal data, with a description, if you process any.
  3. Preview and sign. Preview and sign opens the full text. After reading it, tick the confirmation box and press Sign. The legally binding text is Turkish.
  4. Wait for VeriTeknik's signature. The card shows Awaiting VeriTeknik signature. You are notified when we countersign.
  5. Download the PDF. Once both signatures are in, Download PDF gives you the signed text.

Who can sign?

Signing needs company editing permission and happens only in the web portal. Morpheus or any AI agent cannot sign on your behalf; saying "I accept" without reading is a Vogon habit, not ours.

Working on behalf of your own customers

Choose On behalf of our own customers in the form. The agreement then names you as the data processor and VeriTeknik as your sub-processor, and a role chain paragraph is added to clause 1.

Statuses#

Status Meaning
Being prepared The agreement is not ready to sign yet. You are notified when it is.
Awaiting information Company details or the form are missing.
Awaiting your signature The form is complete; you can preview and sign.
Customer signed You signed; VeriTeknik's signature is pending.
Fully signed The agreement is in force; the PDF can be downloaded.

What the agreement covers#

The text is generated from the actual state of your service, so your agreement says only what holds for your servers.

  • Where the data lives: Customer data, on disks, in snapshots and in backups, is kept only in Türkiye, in the data centers the agreement lists. VeriTeknik does not transfer the data abroad or access it from abroad.
  • DDoS exception: If your server is in the Ankara data center, network traffic may temporarily pass through a filtering service abroad (StormWall) during large DDoS attacks. This happens only while an attack lasts; the filtering service only filters network traffic and has no access to servers or disks.
  • Protection backup: VeriTeknik's free daily protection backup is kept in the data center where the server is and is not copied to another location.
  • Sub-processors: The companies operating the data centers your servers are in are listed with their legal names and addresses. You get written notice at least 30 days before a sub-processor is added or replaced.
  • Morpheus: Our AI-assisted management assistant is switched off under this agreement. If you want to enable it, an annex is added to the agreement in writing first.

Removing Morpheus access#

On virtual servers delivered from a ready-made operating system image, an access path is prepared on first boot so that Morpheus can connect later:

  • a system user named morpheus (password locked),
  • passwordless sudo for that user (/etc/sudoers.d/morpheus),
  • Morpheus's SSH public key in that user's ~/.ssh/authorized_keys,
  • a marker file at /opt/veriteknik/.morpheus-agent.json.

No agent is installed on the server. VeriTeknik does not use this access unless you enable Morpheus in the portal. If you would rather the door did not exist at all, you can remove it; removing it does not affect the service:

sudo userdel -r morpheus
sudo rm -f /etc/sudoers.d/morpheus /opt/veriteknik/.morpheus-agent.json

After removal

Morpheus cannot connect to a server where this access has been removed. If you change your mind, write to destek@veriteknik.com and we will set it up again together.

Don't panic

If you have a question about the agreement, or the card does not look the way you expect, write to destek@veriteknik.com. The answer may not be 42, but it will make sense.