Where does the KVKK technical measures list live in the box?

The list exists; the mapping does not

In a KVKK compliance project, your adviser or the authority's published guidance hands you a list of technical measures. The list is written generically: "encryption is applied", "access rights are limited", "logs are kept". The hard part is tying each sentence to the system you actually run.

This article makes that connection for the guest Wi-Fi process. For every heading we say three things: what it means, where it lives in the box, and what stays on your side. Your adviser can lift the table straight into your compliance file.

In one table

Measure heading	Where it lives in the box	What stays with you
Data minimisation	Only verification detail, MAC, internal IP, session times; no sites, content or location	Not adding extra fields
Encryption	Guest phone numbers are stored encrypted	Physical security of the box
Access control	Role-based panel rights; numbers only for an authorised role, masked	Assigning roles to the right people
Logging and monitoring	Audit trail; alarms for NTP drift, disk, timestamp service	Connecting alarms to a channel someone reads
Integrity	SHA-256 hash chain + RFC 3161 timestamp	Running periodic verification reports
Backup	Second copy of the archive off the box over SFTP/FTPS	Security of the target server and its deletion schedule
Network segmentation	Guest VLAN; the box is the guest network's firewall	Client isolation on APs, VLAN plan
Retention and disposal	Automatic deletion after 730 days, written to the audit trail	Deleting the external copy on the same schedule
Key and credential management	Encryption key on the box; SMS API credentials from platform to box; timestamp signature by an external service	Credential inventory for panel accounts and SFTP

Data minimisation

The most effective technical measure is not collecting the data in the first place. The box keeps the guest's verification detail (SMS-verified number, coupon code or e-mail), the device MAC address, the assigned internal IP, session start and end, and the NAT mapping where applicable. There are no visited sites, no content, no location and no social media profile. Unless you enable the optional DNS query log, that is the whole field list. Your part: do not ask for unnecessary fields such as full name on the portal.

Encryption

The guest's phone number is stored encrypted on the box and displayed masked in the panel. Record files are additionally protected by the hash chain. The box is a network device; it belongs in a locked cabinet or technical room. Against someone who removes the disk and mounts it elsewhere, the strongest measure is restricting physical access to the box.

Access control

The panel is role-based. Only an authorised role sees guest phone numbers, and sees them masked. Technical staff can verify record integrity without seeing a number. Two tasks stay with you: assign roles to real people according to their duties, and close the accounts of staff who leave. Both actions appear in the audit trail.

Logging and monitoring

There are two separate logs. The access record describes the guest; the audit trail describes the administrator: who did what in the panel, and when. Automatic deletions are written to the audit trail as well. On the monitoring side the box watches disk usage, the state of the timestamp service, SMS credit and offline status, and sends alarms by e-mail, Telegram or webhook. If NTP drift grows, a warning appears in the panel. Your part: connect the alarms to a channel somebody actually reads.

Integrity

Each day's record file is hashed with SHA-256, chained to the previous day and given an RFC 3161 timestamp. Only the digest goes to the timestamp service, never the records. You can verify with one click in the panel and download a report. Make a habit of pulling one verification report a month for your compliance file; those reports are the answer to "do you check integrity".

Backup

Records stay on the box; they do not go to a cloud, abroad or to us. Against hardware failure you can push a second copy of the archive to your own server over SFTP/FTPS. The exported archive contains day folders, line files, the SHA-256 manifest and the timestamp file, and can be verified without the box using openssl ts -verify. Your part: access control on the target server and applying the 730-day rule there too.

Network segmentation

The guest network runs on its own VLAN; the box is its firewall (pfSense based). Guest traffic does not reach the till, cameras, printers or servers. Devices that must stay on the guest network, such as printers, POS terminals or TVs, are kept out of the portal with a MAC exemption. With client isolation enabled on the access points, guests cannot see each other either. The box does not replace a corporate UTM; your existing firewall stays in place.

Retention and disposal

Access records are kept for 730 days. Expired days are deleted automatically and the deletion is written to the audit trail. That lets you answer "is your disposal policy enforced" with records rather than a document. If a guest submits a request (deletion or access), you handle it in the panel and can anonymise the record.

Key and credential management

An honest distinction is needed here:

• The key that encrypts guest numbers lives on the box and does not go to the platform.
• SMS provider API credentials are handed from the platform to the box; nothing travels the other way, and the guest number never reaches the platform.
• The timestamp signature is produced by an external service; you do not hold that key, and you do not need to.

What stays with you: a small key and credential inventory covering panel administrator passwords, SFTP/FTPS credentials and the physical location of the box. A three-row table is enough.

Conclusion

Every heading on the technical measures list has a counterpart in the box, but none of them is "set and forget". Assigning roles, reading alarms, protecting the external copy and keeping the box locked remain on your side. Deployment options are on the box and virtual appliance pages.

This article is for general information only and is not legal advice.