Trust
AI prepares the work. Responsibility stays with the organization.
These principles describe how the platform is built. Items not yet complete carry their status.
Highlights
- Where personal data is processed
- Türkiye
- Personal data is processed by models on in-house servers in Türkiye and is never sent to an outside AI service.
- Binding actions started by AI
- None
- Uncertain fields go to a person; actions such as issuing a policy are started by staff or by agreed rules.
- Personal Data Protection Law
- 6698
- Personal data is processed in line with this law, and controller and processor roles are set out in the contract.
AI can't carry an intermediary's responsibility. So we wrote down, up front, what it may do and what it may not: personal data stays in-house and in Türkiye, every field read shows its place in the document, and AI never starts a binding action. Whatever is not built yet carries its status.
Trust
AI principles
Personal data is processed in-house
Personal data is processed only by models running on in-house servers in Türkiye.
Outputs show their source
Every field read shows its place in the document. In the Q&A prototype each answer comes with the page it relies on; in the planned assistant every answer will come with its source, or with “not found”.
Some decisions are never left to AI
Premium, insurer connection and permission decisions follow rules and people.
AI never starts a binding action
Irreversible actions such as issuing a policy are started by staff or by rules the intermediary has agreed with a partner, never by AI.
The path of a document
Where data is processed, who approves, and what remains.
It stays in-house
A document with personal data is not sent to an outside AI service. Models run on in-house servers in Türkiye.
Only anonymous data goes out
An outside model may be used only to generate training examples from anonymous or synthetic data; personal data does not cross this line.
It comes with its source
Every field read points to its place in the document. A field whose confidence falls below the threshold is not written to the record on its own; a person is asked.
AI starts no binding action
Premium, insurer-connection and permission decisions belong to rules and people; AI never starts a binding action. The approval card will come with the planned assistant.
A trail remains
Who accessed which personal data, and who approved or corrected which field, will be recorded. Tenant isolation and the audit log are prototypes today.
- 01 / 05
It stays in-house
A document with personal data is not sent to an outside AI service. Models run on in-house servers in Türkiye.
- 02 / 05
Only anonymous data goes out
An outside model may be used only to generate training examples from anonymous or synthetic data; personal data does not cross this line.
- 03 / 05
It comes with its source
Every field read points to its place in the document. A field whose confidence falls below the threshold is not written to the record on its own; a person is asked.
- 04 / 05
AI starts no binding action
Premium, insurer-connection and permission decisions belong to rules and people; AI never starts a binding action. The approval card will come with the planned assistant.
- 05 / 05
A trail remains
Who accessed which personal data, and who approved or corrected which field, will be recorded. Tenant isolation and the audit log are prototypes today.
- Illustrative. Names and values shown are examples. Where data is processed, It stays in-house, Only anonymous data goes out, It comes with its source, AI starts no binding action, A trail remains.
Data protection (KVKK)
Personal data is processed in line with Türkiye's Personal Data Protection Law No. 6698. Controller and processor roles are set out in the contract. Retention periods, anonymization and personal data access logs are being built as part of the platform foundation.
In-house models
Documents containing personal data are never sent to an external AI service. Models run on in-house servers. An external model may be used only to generate training examples from anonymous or synthetic data.
Data in Türkiye
Customer data and the models that process it run on servers in Türkiye.
Tenant isolation
Each intermediary will be a separate tenant; data will be separated at the database level, and one intermediary's insurer credentials will not be usable in another's work. This runs as a prototype in the new shared foundation, on sample data only. Today's live workspace is an installation dedicated to a single intermediary.
Human approval
Today a field below the confidence threshold is never written to the record on its own; a person is asked. AI does not start binding actions such as issuing, cancelling or endorsing a policy; staff, or rules agreed with a partner, start them. An assistant that holds irreversible actions on an approval card is on the roadmap; without approval, it will do nothing.
Audit trail
Who accessed which personal data, and who approved or corrected which field, will be recorded. The prototype of the new shared foundation keeps an audit log for every quote, transfer and document read; that prototype runs on sample data only.
Safeguards
The safeguards behind the principles.
Below are the technical and process measures that put the principles into practice. Those running in production and those built as prototypes in the new foundation are marked separately.
Live: in daily operational use. Pilot: being tried in real work. Partly live: part of it is in daily use, the rest is in development. Prototype: a research experiment. Roadmap: in development, not yet in use.
- 01
Registration images stay in-house
Registration reading runs on an in-house service closed to the internet, on CPU, with no GPU needed. Images are processed in memory and discarded; the service has no permission to write to disk.
Live - 02
No value reaches the form without a person
Read values appear in an editable table, side by side with the image snippet cut from the registration, and reach the form only when staff press 'Apply to form'. The owner's name and identity or tax number are shown only for checking and are never written to the form.
Live - 03
Rules that run independently of the model
Every value is also checked against a fixed format rule: plate format, chassis-number length, the document-serial pattern, the checksum of identity and tax numbers, and model-year range. A field that breaks its rule or falls below the confidence threshold arrives with a 'Check' badge.
Live - 04
Premiums come only from insurers
The panel does not calculate premiums; every price is an insurer's web service response. No request goes to an insurer without a connection, and no estimated price takes its place. If a price has expired, the panel blocks the policy record.
Live - 05
Server-side permission checks
A user's role, menu permissions, access level and department scope decide what they can see and change. Buttons they cannot use do not appear, and the server applies the same rule independently for every menu area.
Live - 06
Masking and read-only transfer
Before insurer requests and responses reach the logs or the technical detail view, the panel masks the password, username, API key, ID number and tax number fields it recognizes. Policy lists pulled read-only from insurers are never written to the database, show ID numbers masked and are cleared when you leave the page.
Live - 07
Encrypted insurer credential vault
In the new shared foundation, insurer credentials are stored with envelope encryption under a data key for each intermediary. An encrypted block moved to another intermediary's record cannot be decrypted, and secrets cannot be read back through the API. Authentication errors are never retried, so the agency's insurer account is not locked out.
Prototype - 08
Tenant isolation, roles and audit log
In the new shared foundation, each agency is a separate tenant, and data is isolated at database level with PostgreSQL row-level security. There are agency admin, operations staff and viewer roles, and every quote, transfer and document read is written to an audit log. This foundation runs only on sample and synthetic data and holds no real agency data.
Prototype
Use cases
The principles in daily work.
- 01
An uncertain chassis number
On the quote screen, staff press 'Fill from registration' and upload a photo of the registration. The image is read by the in-house service and not stored. The chassis number fails its format rule, so it arrives with a 'Check' badge and the image snippet cut from the registration. Staff look, correct it and apply it; until they do, the value does not reach the form.
- 02
Offers stopped before they reach the customer
A motor liability quote request comes in from the customer app, which is in pilot. Staff upload the price comparison PDF; the panel extracts the offer rows with insurer and gross premium and checks the ID number and plate against the request. If either does not match, the offers are not published, and a row whose amount cannot be read with certainty is left out with a warning. Staff publish only after seeing every warning, and the prices read cannot be edited by hand.
- 03
A policy waiting on an approval card
In the planned assistant, staff will ask for a policy to be issued for a customer. The assistant will not finish the job on its own: a card will show who it is for, with which insurer and at which premium. No policy will be issued until staff tap the card, and the action will be written to the audit trail as performed through the assistant with their approval. The assistant and its agents are on the roadmap.
Questions
Frequently asked questions
Is our data sent to an AI company?
No. Documents containing personal data are never sent to an outside AI service; models run on in-house servers. An outside model may be used only to generate training examples from anonymous or synthetic data. An organization's data may be used for model training only with its explicit consent and after anonymization.
Where are the servers?
Customer data and the models that process it run on servers in Türkiye. Registration reading, live today, runs on an in-house service closed to the internet and is reached only through signed-in endpoints of the panel or the mobile API. In the planned assistant, too, the model will run on in-house servers, not on the phone.
Who is the data controller and who is the processor?
Controller and processor roles are set out in the contract. Personal data is processed in line with Türkiye's Personal Data Protection Law No. 6698. Retention periods, anonymization and personal data access logs are being built as part of the platform foundation.
Which safeguards work today, and which are on the roadmap?
Live today: in-house registration reading, asking a person about any field below the confidence threshold, premiums that come only from the insurer's response, server-side permission checks and masking in logs. The live workspace is an installation dedicated to a single insurance intermediary. Tenant isolation, the encrypted credential vault, roles and the audit log are prototypes in the new shared foundation and run only on sample data. Putting these into real use, and the assistant that will work with approval cards, are on the roadmap.
Can AI issue a policy on its own?
No. Premium, insurer-connection and permission decisions follow rules and people, and the premium comes only from the insurer's response. By design, AI never starts binding actions such as issuing, cancelling, endorsing a policy or opening a claim; at most the model suggests the form, and a person starts the action. The automatic motor liability issuance in a corporate partner's flow uses no AI: it follows rules agreed with that partner, and every record appears in the operations queue.
How is access to personal data recorded?
Today, access is checked on the server for every menu area, and a person's role, menu permissions, access level and department scope decide what they can see and change. An audit trail that records who accessed which personal data, and who approved or corrected which field, is on the roadmap. The prototype of the new shared foundation keeps an audit log for every quote, transfer and document read; that prototype runs only on sample data.