Data discovery is the process of finding where sensitive data actually lives across an organization’s file shares, databases, object storage, collaboration platforms and mail archives, then classifying what was found. Seratus performs discovery remotely and without agents, and records each scan as evidence.

DSPM answers three questions continuously: where is the data, who can reach it, and how risky is that combination. It joins discovery and classification with an access and exposure graph, so that risk can be ranked and remediated. Seratus is a DSPM console deployed on the organization’s own infrastructure.

Agentless means no software is installed on endpoints or servers that hold the data. Seratus connects to each source remotely over a read-only connection and scans from there. This removes rollout projects, endpoint performance concerns and change-management friction, and it keeps the scanned systems untouched.

File servers (SMB/CIFS, NFS) and local disks on Windows, Linux and macOS, Microsoft 365 (SharePoint Online, OneDrive, Teams files), Oracle Database, Microsoft SQL Server, PostgreSQL, MySQL and MariaDB, S3-compatible object storage (Amazon S3, MinIO, Ceph) and email archives (PST, OST, MSG). Planned sources are listed separately on the roadmap page and are not described as available.

Personal data is any information relating to an identified or identifiable person. Special-category personal data is a narrower set that carries higher risk when exposed, such as health or biometric data. Sensitive data is the wider business term and also covers trade secrets, pricing, bids, customer terms and other competitively sensitive information. Seratus classifies all of these on type, confidentiality level and business category.

Data loss prevention (DLP) is the set of controls that stop sensitive data from being exposed, moved or shared where it should not be. Classic DLP watches channels such as email or endpoints. Seratus starts one step earlier: it finds the data at rest, maps who can reach it and removes exposure through masking, quarantine or deletion, with every action recorded.

Seratus is a data security posture (DSPM) and compliance console with remediation. It covers data-at-rest discovery, exposure analysis and remediation, which is where most DLP programs fail first. Channel monitoring and blocking (web, messaging, webmail) is in development and is not sold as an available capability.

Oversharing is access that exceeds need: a payroll file readable by “everyone”, an anonymous sharing link to a contract, a database role that reaches every table. Seratus collects permissions (ACLs, sharing links, database roles) alongside content findings and builds an exposure graph that ranks these combinations by risk.

Yes. Findings and remediation actions can be forwarded to SIEM and ticketing systems, and users and scope can be synchronized from the directory (LDAP).

Data masking replaces sensitive values with substitutes so that the data remains usable for its purpose while the original value is no longer exposed. In Seratus, masking is a remediation action assigned to an owner, subject to approval, and written to the audit log with who, when and why.

Anonymization removes the link to a person irreversibly, so the result is no longer personal data. Pseudonymization replaces identifiers with a key or token but keeps a way back, so the data is still personal data and still needs protection. Seratus treats disposal by anonymization as producing a redacted copy and destroying the original, with quality measured through uniqueness checks.

Every disposal produces a record: what was located, in which sources, which action was approved by whom, when the original was destroyed, and the uniqueness check result on the redacted copy. The record is attached to the request or retention event it belongs to, so an auditor can read the chain end to end.

Seratus runs the operational side of KVKK in one console: the VERBİS inventory built from real discovery results rather than questionnaires, data subject requests (DSAR) located across sources, a retention calendar, breach records, and disposal or anonymization with evidence. Legal interpretation remains with the organization’s legal function.

A data subject request is a person asking what data an organization holds about them, or asking for correction or deletion. Seratus receives the request, locates the person’s data across connected sources, produces the response or the redacted copy, carries out approved disposal and attaches the evidence to the request.

The operational mechanisms are shared: discovery, classification, access review, request handling, retention and disposal with evidence. Seratus is built and tested first for Turkish data and KVKK processes; organizations with GDPR obligations use the same inventory and request workflows.

Generic detectors tuned for other languages miss Turkish identifiers and produce false positives on Turkish text. Seratus’s detection engine was developed specifically for Turkish; national ID numbers, IBANs, phone numbers and special-category data are detected in context, and every rule has its own accuracy and false-positive reduction program.

Competition-law compliance is an organization’s program for avoiding conduct that competition authorities investigate, such as exchanging competitively sensitive information with competitors or coordinating prices and bids. Much of that risk lives in documents, spreadsheets and mail: pricing, bid terms, customer conditions and messages that reference competitors. Knowing where such material is, who can reach it and how it is shared is a data question before it is a legal one.

It applies the same discovery, classification and exposure engine to competition-law risk: it identifies documents and communications that may carry competitively sensitive information, shows who can reach them and how they are shared, routes them into a review and remediation workflow with approvals, and records every decision as evidence. It supports the organization’s compliance program; it is not legal advice and does not replace counsel.

Before: the organization can find and reduce risky material proactively, tighten access and show a working compliance program. During: it can locate relevant documents across sources quickly and demonstrate, with audit records, what controls were in place and what actions were taken and when.

Typically non-public information that would let competitors align behaviour: current or future prices and discounts, bid and tender terms, costs and margins, customer-specific conditions, capacity and output plans, and strategic plans. Seratus lets the organization define and tune these categories in its taxonomy rather than relying on a fixed list.

Seratus is installed on the organization’s own servers (on-premises) and supports fully air-gapped networks. Scanning, classification and reporting happen inside the organization. Nothing is sent out to be analyzed.

Core detection does not depend on a large language model. Optionally, the organization’s own or a private LLM hosted on its infrastructure can enrich tasks such as document type and request summaries. This works air-gapped and under a data-minimization agreement; no data is sent to external AI services.

Role-based access separates scanning, review, approval and administration. Installation and updates ship as signed packages that can be verified. The interface is available in Turkish and English.

Because there are no agents, the first scan can start as soon as the console is installed and a read-only connection to the first source is configured. Scope is then widened source by source. Interrupted scans resume where they stopped.