Resources · Security · Infrastructure and data protection
Your data stays in data centers in Istanbul, and sensitive fields are encrypted individually
The Mundi platform and its production databases run in data centers in Türkiye. Your bank connection details, personal data and sensitive financial information are encrypted at field level with AES-256-GCM, and the keys are kept in a separate key management system.
- ISO 27001 Certification complete
- KVKK Data kept in Türkiye
- Independent penetration test Completed in September 2026
A record's path, from your screen to the database
-
Location
In Türkiye, in data centers in Istanbul
The Mundi platform and its production databases are hosted in data centers in Istanbul and run in line with KVKK (Türkiye's personal data protection law, Law No. 6698). Cross-border data flows are limited to a defined set of sub-processors.
Load balancing and automated backups keep the platform running. The database can be restored to any chosen point in time.
Control · Hosting in Türkiye, automated backups
-
Transit
Encrypted in transit
All communication between the platform and your browser or mobile app runs over an encrypted connection. A request over an unencrypted connection is automatically redirected to an encrypted one.
Control · Encryption in transit
-
Storage
Sensitive fields encrypted individually
Bank connection details, personal data and sensitive financial information are stored with field-level encryption using AES-256-GCM.
In system logs, Turkish national ID numbers, IBANs and phone numbers are masked automatically. Passwords and security codes are never written to system logs.
Control · Field-level encryption, masking in logs
-
Keys
Keys kept apart from the code
Encryption keys are protected in a centralized key management system and never appear in source code. Other secrets the systems use are also kept in a centralized secrets management system.
Control · Centralized key management
-
Access
Who can access what
Every request is authorized on the server side. Each user sees only the bank accounts made visible to them.
Passwords are stored one-way, and no Mundi employee can see user passwords. Services run in separate network segments, on the principle of least privilege.
In the mobile app, login credentials are kept in the device's secure storage. When a device is lost, Mundi's operations team can lock the user's account and end their open sessions remotely.
Control · Access by role and by account
-
Monitoring
Monitored day and night, records never deleted
All systems are monitored 24/7, and unusual activity is detected automatically. User actions and financial movements are recorded in immutable audit logs.
Approver and Full Authority users see the log of role, visibility, invitation and session changes in the platform.
Control · 24/7 monitoring, immutable log
User management log
- 10:42 Role change · User C · from Preparer to Approver · User B
- 10:40 Account visibility · User C · Bank B current account added
- 09:58 Invitation · User D · with the Viewer role
- 09:12 Session · User A · second verification passed
Cannot be deleted or changed
-
Documents
Independent audit and certification
-
ISO 27001
Our Information Security Management System certification is complete. The certification was carried out through a body accredited by the Turkish Accreditation Agency.
-
KVKK
Your personal data is stored in data centers in Türkiye, in line with KVKK.
-
Independent penetration test
An independent security firm completed the penetration test and vulnerability assessment in September 2026.
We share the detailed test report and our technical security package under a non-disclosure agreement. You can send your request to destek@getmundi.app.
-
More
You
Let's answer your IT team's questions together
In a 30-minute call we go through your hosting, encryption and access questions with your team.
Mundi is not a bank and does not give investment advice. Investment transactions are executed through Tacirler Yatırım Menkul Değerler A.Ş., licensed by SPK.