Legal

GDPR and KVKK

Our processing roles and the technical measures behind them.

This is not legal advice. It describes what the product actually does and can be used as a starting point, but assessing your obligations is your counsel's job. The technical claims are documented in detail in the privacy documentation.

Roles

Scenario	Controller	Processor
Cloud version	You (the site owner)	Vitrus
Self-hosted	You	None — the data never reaches us
Your Vitrus account	Vitrus	—

Why a consent banner may not be required

Consent obligations usually turn on access to terminal equipment (writing cookies or localStorage) and on processing personal data. Vitrus:

Uses no cookies or localStorage — nothing is written to the device
Mints no persistent identifier — the id changes every day
Never stores the IP address — it is only an input to a one-way hash
Does not profile individuals or stitch identities across devices

What that means in your specific context is a question for your counsel. We only document what the product does.

Strict mode

If your counsel wants the smallest possible footprint, strict mode drops country, screen size, referrer query strings and cross-day identity, and makes Do Not Track non-overridable. It is enforced server-side, so it holds even if the browser script is modified.

Technical and organisational measures

TLS in transit; server access by key-based SSH only
Tenant isolation is tested: one account cannot reach another's data, and that is verified automatically on every build
Passwords hashed with argon2id; changing a password invalidates every session
Site-owner identities (identify) are hashed one-way; the raw value never touches disk

Data subject requests

For your visitors: because there is no persistent identifier and no stored IP, locating a single visitor retroactively is technically impossible — which means less that we cannot honour a deletion request, and more that the data was never linkable to a person. For your own account data, write to us.