What is Seratus: agentless data discovery and KVKK console

Most organizations hold two versions of their personal data inventory: the answers people gave to a questionnaire, and what actually sits on disks, in database columns and behind sharing links. Seratus was built to close the distance between the two. It finds data where it lives, shows who can reach it, runs remediation through an approval flow and records every step as evidence an auditor can read, on the organization’s own servers and without installing anything on the systems it scans.

The question Seratus answers

Information security, compliance and legal teams ask the same three questions during every audit, every data subject request and every suspected breach. Where is the data? Who can reach it? How risky is that combination? Seratus is a data security posture management (DSPM) console that answers those three questions continuously and with evidence. On top of that core sits a KVKK suite, which carries the operational duties of data controllers under Türkiye’s data protection law, and a competition-compliance module that makes competitively sensitive information visible.

The product does not offer a legal interpretation of what a data controller must do; that remains with the organization’s legal function. Seratus produces the facts that legal and audit rely on: which file holds which data, which column contained which identifier, who can open which folder, which sources were searched for which request, and what was done about it.

This mirrors the logic the Personal Data Protection Authority sets out for the Data Controllers Registry (VERBİS): the inventory is meant to be a record of what the organization actually processes, not a declaration. Seratus builds the inventory from discovery, not from a survey.

The five-step flow: Define, Scan, Review, Remediate, Prove

Every screen in Seratus is arranged around a single flow. That flow stays the same from the first day of a data security program to the day of the audit.

Define. The organization sets up its taxonomy in its own language: which data types to look for (national ID numbers, IBANs, health data, contract terms, price lists), which confidentiality levels to use (from public to top secret), which business categories matter (HR, finance, sales, legal). Scope is defined here as well: which shares, which database schemas, which SharePoint sites. Users and scope can be synchronized from LDAP or the directory.

Scan. Seratus connects to each source remotely over a read-only connection and reads the content. File servers, local disks, Microsoft 365, relational databases, object storage and email archives are all scanned by the same engine. An interrupted scan resumes where it stopped; for Microsoft 365, only changes (delta) are processed after the first full pass.

Review. Findings arrive classified by type, confidentiality level and business category, each with a confidence percentage and a masked sample. The access and exposure graph places “who can reach this” next to every finding. Human-approved correction happens here: false positives are marked, labels are changed, the taxonomy learns.

Remediate. For a risky finding, an action is started: masking, quarantine, permission removal, deletion or disposal, label application. The action is assigned to a named owner, approved by a second person with separate authority, and executed.

Prove. Each step is written to the audit trail with who, when and why. Reports (KVKK readiness summary, audit report, per-source detail, executive summary) are produced as PDF, Excel or CSV. Findings and actions can be forwarded to a SIEM or a ticketing system.

Discovery: sources and how they are connected

The discovery layer focuses on the places where data actually accumulates inside an organization. The sources supported today, and how each is connected, are as follows:

Source	Connection	Note
File servers (SMB/CIFS, NFS)	Remote mount, read-only	Folder and file ACLs are collected
Local disks on Windows, Linux, macOS	Remote, agentless	Files with unreadable permissions are still scanned; the condition is reported as a warning
Microsoft 365 (SharePoint Online, OneDrive, Teams files)	Microsoft Graph, read-only application permission	Full scan, then delta
Oracle, SQL Server	Read-only (db_datareader on SQL Server)	Sampling-based, role-to-table permission graph
PostgreSQL, MySQL, MariaDB	Read-only	Table as container, column as the scanned unit
S3-compatible object storage (Amazon S3, MinIO, Ceph)	SigV4 signing in our own code	Bucket policy or ACL is graphed when readable
Email archives (PST, OST, MSG)	File-based	Message bodies and attachments; no live mailbox connection

The same principle applies everywhere: Seratus writes nothing to and installs nothing on the scanned system. The agentless DSPM and integrations pages describe each source.

Classification and Turkish-specific detection

Discovery is only as useful as the naming of what it finds. Seratus labels every asset along three axes: type (for example national ID number, health data, contract), confidentiality level (public, internal, confidential, top secret and so on) and business category. The taxonomy is manageable, and labels are tied to policy and to retention and disposal processes; a file labelled “top secret, HR” triggers both an access policy and a retention schedule.

The detection engine was developed specifically for Turkish data. National ID numbers (TCKN), tax identification numbers, Turkish IBANs, card numbers, email addresses, Turkish phone numbers, vehicle plates and ICD-coded health data each have their own rule, their own accuracy measurement and their own false-positive reduction program. Every finding is shown with a confidence percentage and a masked sample, so the reviewer can decide without seeing the actual value. Because database scanning is sampling-based, “not found in the sample” is a technical finding rather than a risk verdict, and the product says so explicitly. The Turkish detection accuracy page goes into this further.

The access and exposure graph

The existence of a payroll file is not in itself a risk; the fact that “everyone in the organization” can read it is. Seratus therefore places permission data next to every content finding. ACLs from file servers, sharing links from Microsoft 365 (anonymous links, “everyone in the organization”) and roles from databases are collected into an identity-permission-asset graph.

The graph surfaces patterns that are hard to notice on their own: overshared folders, publicly reachable objects, still-valid access held by users who have left, unresolvable SIDs, circular group memberships. Each finding is ranked by risk in that context. The access and exposure graph page explains this view.

Remediation and evidence

Discovery that does not turn into action is just a report. In Seratus, remediation is a workflow: the finding is assigned to an owner, an action is chosen (masking, quarantine, permission removal, deletion or disposal, label application), a second person with separate approval authority approves, and the action runs. Approval and execution authority are separated by role-based access; scanning, reviewing, approving and administering need not be the same person.

Every step is written to the audit trail: who, when, why. For disposal, Seratus produces a redacted copy, destroys the original and measures quality with a uniqueness check; the record is attached to its request or retention event. The remediation and evidence page shows the flow step by step.

The KVKK suite and the competition-compliance module

The KVKK suite carries the operational side of the law in one console. The VERBİS inventory is built from real discovery results; data subject requests (DSARs) are received, the person’s data is located across connected sources, a response or redacted copy is produced, approved disposal is executed and the evidence is attached to the request. The retention schedule is tied to labels; breach records and data protection impact assessments are kept in the same place. The KVKK readiness score and the “gaps” list show where the organization stands in concrete terms: special-category data in wide sharing, an overdue request, data past its retention period, data missing from the inventory. The KVKK compliance page covers the suite.

The competition-compliance module applies the same discovery, classification and exposure engine to a different risk. It detects documents and communications that may carry competitively sensitive information (prices, bid and tender terms, costs and margins, customer-specific terms, capacity plans), shows who has access and how the material was shared, routes it into an approved review and remediation flow and records the evidence. Categories are configured in the organization’s own taxonomy. The module does not give legal advice; it supports the organization’s compliance program.

Why agentless, and why on-premises

Being agentless is a design principle, not a preference. Installing software on the servers that hold data means a change-management project, a performance debate and a security review in every organization. Seratus connects to each source remotely over a read-only connection; the scanned systems are not touched, which is why the first scan can begin the day the console is installed.

On-premises deployment follows the same logic. Sending personal and special-category data to a cloud service in order to find it enlarges the problem being solved. Seratus is installed on the organization’s own servers from signed packages, runs in air-gapped networks, is governed by role-based access and offers a Turkish and English interface. Optional LLM enrichment (document type, request summaries) uses only the organization’s own or privately hosted model; no data goes to an external AI service. The private LLM and air-gap page sets out those boundaries.

How Seratus closes these gaps

Even in a product overview it is worth naming the gaps, because every capability in Seratus corresponds to one that keeps appearing in the field.

• The distance between the inventory and reality. A survey-based inventory does not reflect what discovery finds. Seratus builds the VERBİS inventory from an actual scan and lists “data missing from the inventory” as a gap (KVKK compliance).
• Data that was found, but with no idea who can reach it. Content scanning alone cannot measure risk. The access and exposure graph places ACLs, sharing links and database roles next to the finding (access and exposure graph).
• False positives on Turkish identifiers. Engines tuned for other languages miss TCKNs and Turkish IBANs or produce noise in Turkish text. Turkish-specific rules are reviewed with a confidence percentage and a masked sample (Turkish detection accuracy).
• Reports with no action behind them. A list of findings is not evidence in an audit. The approved remediation flow and the who/when/why audit trail turn “we did it” into “here is the proof” (remediation and evidence).
• Exporting data in order to find it. On-premises, air-gap-compatible deployment and a private LLM keep the analysis inside the organization (private LLM and air-gap).
• Invisible competitively sensitive information. Price lists and tender files are not personal data, so they fall outside conventional inventories. The competition-compliance module finds them with categories defined in the taxonomy and routes them to review.

Takeaway

Seratus treats data security and KVKK compliance as one flow fed by the same facts rather than two separate projects: Define, Scan, Review, Remediate, Prove. Agentless discovery and on-premises deployment keep that flow inside the organization’s boundaries; the audit trail and the reports leave a trace of every decision. The entries that follow take each part of the flow in turn: why data is both the most valuable and the riskiest asset, why discovery comes first, how agentless scanning works and what a data controller’s duties look like in practice. The features and FAQ pages hold the details.