What a case looks like

Situation

A request arrives by email. The person’s data may sit in HR shares, a CRM database, old mail archives and a SharePoint site. The legal clock is running and nobody knows which systems to search.

What Seratus does

The request is logged in the KVKK suite. Seratus locates the person’s records across connected sources using the identifiers in the request, produces the response or a redacted copy, and routes any disposal through approval.

Evidence produced

Request record with timestamps, list of sources searched, findings per source, approval decision, disposal record with uniqueness check.

Situation

A spreadsheet with salaries and IBANs was shared with “everyone in the organization” on OneDrive two years ago. Nobody remembers. It is still there.

What Seratus does

Microsoft 365 discovery finds the file, classifies the IBAN and salary content, and the exposure graph flags the organization-wide link. A permission-removal job is assigned to the file owner and approved by a second person.

Evidence produced

Finding with masked sample and confidence, exposure path, assignment, approval chain, before/after permission state in the audit log.

Situation

An account was disabled in the directory, but group memberships still grant read access to finance shares, and an unresolved SID lingers on an old folder.

What Seratus does

The exposure graph lists disabled principals, dangling memberships and unresolved SIDs that still reach sensitive objects, ranked by what they can reach.

Evidence produced

Principal-to-object report for the data type, remediation jobs per share, audit entries for each permission change.

Situation

Old recruitment files and customer records sit on a file server years after their purpose ended. The retention schedule exists on paper; nothing enforces it.

What Seratus does

The retention calendar is bound to classification labels. Expired items appear as a KVKK gap; disposal or anonymization runs as approved jobs that produce a redacted copy and destroy the original.

Evidence produced

Gap list, per-item disposal records, uniqueness-check results, updated inventory.

Situation

Bid calculations, price lists and competitor correspondence live in a “Tenders” folder on a shared drive with broad read access. A competition-law review is coming.

What Seratus does

The competition module classifies competitively sensitive material by the organization’s own taxonomy, shows who can reach it, and routes access narrowing through review and approval.

Evidence produced

Inventory of sensitive documents, access report, decisions with reasons, timeline of changes. Not legal advice; supports the compliance program.

Situation

An employee wants a quick summary and pastes a customer contract, with names and IBANs, into a public AI chat in the browser.

What Seratus does

The endpoint agent recognizes the content with the same classification rules used in discovery and applies the channel policy for AI assistants: warn, or block and explain. The event lands in the audit log next to the data-at-rest findings for that file.

Evidence produced

Endpoint event with channel, policy, action and user; link to the file’s classification; exception request if one was raised.

Situation

Workplace physician reports and sick notes were scanned into an HR folder for convenience. Special-category data now sits next to ordinary files, readable by the HR group and a few others.

What Seratus does

Turkish-specific detection recognizes health content in context and labels it special-category. The KVKK status screen raises “special-category data shared widely”; quarantine and access narrowing run as approved jobs.

Evidence produced

Classified findings with confidence, gap record, job history, audit log.