The first question asked when moving to cloud based software is usually the price. The questions that matter later are different: where the data lives, how often it is backed up, and whether you can take it back when you want to leave. On the first day those three feel abstract. On the day something goes wrong they are the only subject.
The answer to the first is plain: data is kept on our own server in Turkey and is not transferred abroad. The platform is multi tenant, meaning each business's data sits in its own space and queries are limited to that space. That separation is not a setting but a rule that applies everywhere data is read; one business's record does not land on another's screen. The customer portal works inside the same boundary: a customer sees only their own orders and nothing of the rest of the workshop.
The answer to the second is a process: an automatic backup is taken every night and backups are kept for seven days. The real issue is not whether the backup is taken but whether anyone notices when it is not. The trouble with backups kept by hand is not that they get forgotten but that the omission surfaces weeks later. For a backup arrangement to be useful it has to be loud when it comes out empty; a job that quietly keeps producing empty files is more dangerous than no backup at all, because it leaves you with the impression that one exists.
The third is the exit. Business data belongs to the user and can be exported even without a subscription. In practice that sentence means the decision to leave the software is not a decision to leave your data behind. An open exit also makes staying voluntary, and for a provider that is healthy pressure.
There is a separation on the payment side too. Payment goes through PayTR and card details never reach our servers. We therefore do not carry the responsibility of protecting card data, because that data never sits with us. The safest data is the data never collected.
Measurement needs stating openly as well, because this is an easy place to be misunderstood. Visits to the marketing site are measured with Google Analytics; it places a cookie and passes the visitor's address to Google. Against that, no advertising tracker, social network pixel, heat map or retargeting is used. The two are not the same thing, and saying there are no trackers at all would no longer be true. Inside the application itself, on the side where business data lives, no measurement of that kind is present.