Backups are where most organisations hold the most personal data and apply the least scrutiny. Yedekalma provides part of the technical measures you need there. Let us be clear from the start: compliance cannot be purchased from a product — you are the data controller.
You choose the data location · data export and account deletion in the panel
"GDPR-compliant backup" gets used like a badge. The accurate statement is this: compliance is a property of the controller, not of a piece of software. A product can only provide the technical measures compliance requires.
This page lists only what we actually do. Producing privacy notices, maintaining records of processing, handling lawful bases and writing a retention and erasure policy remain your obligations. This page is not legal advice.
GDPR Article 32 requires appropriate technical and organisational measures. These are the backup-side equivalents.
When you turn encryption on, backups are encrypted with AES-256 on your server before they leave your source system. The passphrase is known only to you; we do not store it and cannot open the contents.
Backup files are not stored on our servers. Because you choose the destination, you decide where data rests and whether it leaves your jurisdiction. The panel itself is hosted in Türkiye.
Two-factor authentication (TOTP), passkeys and per-domain permissions in the client portal (download / start backup / restore, or view only).
Backup and settings actions in your account are recorded in an audit log you can view in the panel — records that help during breach reporting.
You define how many copies of each backup type to keep; the excess is deleted automatically. This is the technical counterpart of a retention and erasure policy.
On an S3-compatible bucket with Object Lock, a backup becomes undeletable and unmodifiable for a set period, evidencing integrity.
Optional file and database scanning detects malicious code during the backup; in email backups, messages carrying malicious attachments are left out of the archive. It helps you pick a clean restore point.
Every backup goes through 8-layer verification, and the Backup Report Card shows what is on the site next to what is in the backup — closing the gap between "I have a backup" and "my backup works".
We do not mask or anonymise. A backup is a faithful copy of the source. This is deliberate: a modified backup causes data loss when restored. If you need anonymisation it must be handled in the source system.
We do not make compliance declarations on your behalf. We do not sell certificates or "GDPR approval" — be cautious of anyone who does.
We do not process your data. We do not analyse, index or share the contents of your backups — they do not reside on our servers in the first place.
Encryption, access control, retention and an audit log — all in every plan. Free until the end of the year in the current campaign.
Create Free Account