Trust center
VetBis trust center: access control, data protection, certificates and KVKK
Patient records, client details and cash movements are how your clinic runs. VetBis protects them with role and branch-based access, separation of data between clinics and activity records. This page says plainly what is done, who owns what, and what we do not yet commit to.
Access and roles
Security measures in the product
The items below are practices that exist on the product side of VetBis.
See the role and branch-based security feature
Role and branch-based access
Every user is given a role and the branches they can reach. A user without permission does not see the screen or the record.
Separation between clinics
Each clinic's and branch's records are kept apart. Even if one layer had an error, an additional safeguard stops records from mixing.
Audit logs
Important actions are recorded with who did them and when. An administrator can filter these records.
Personal data kept out of technical records
Technical records do not spell out patient or client details.
Channel-based contact consent
Notification consent is kept per channel. The consent record is used so that someone who has not agreed is not contacted.
Protected integration details
Confidential details defined for connections to outside systems are stored protected.
The path of a request: who reaches your data, and how?
When a user opens a record, the request passes five stops. You can pause or pick a stop. The users and records on the screens are fictional.
- Step 1Connection encrypted
Encrypted connection
The connection between the browser and VetBis is encrypted.
- Step 2Signed in
Authentication
The user signs in; the session is kept going securely.
- Step 3Scope limited
Company and branch scope
The user's branch access is checked; only the records of that clinic and branch are returned.
- Step 4Role allowed
Permission check
The system checks whether the user's role allows the requested action.
- Step 5Logged
Audit log
The action is recorded with who did it and when.
Sample screen. The user, branch and records are fictional.
Live flowAudit log 5 / 5
Steps
- 1Encrypted connectionThe connection between the browser and VetBis is encrypted.
- 2AuthenticationThe user signs in; the session is kept going securely.
- 3Company and branch scopeThe user's branch access is checked; only the records of that clinic and branch are returned.
- 4Permission checkThe system checks whether the user's role allows the requested action.
- 5Audit logThe action is recorded with who did it and when.
Data protection
Data ownership and export
Clinic and client records belong to your clinic. VetBis hosts and processes them on your behalf. You can export client and patient records as CSV or XLSX whenever you wish. The same route is used if you move to another program.
- The records belong to your clinic; VetBis processes them on your behalf.
- Export is done from the settings screen and does not need a support request.
- Which data is processed and for what purpose is set out in the legal texts.
Backups, uptime and data location
We do not publish numeric commitments on these topics, because we do not want to present an unmeasured figure, or one not tied to a written contract, as an assurance.
Backups
We do not give figures here for backup frequency or restore times. You can ask for the information you need in writing during the contract process.
Uptime
We do not publish an uptime percentage on this page. The subscription agreement commits to no uptime percentage or service credit.
Data location
We make no firm statement on this page about where data is hosted; you can ask us for written confirmation. The AI assistant is in beta, off by default, and only when a clinic administrator switches it on does it send the minimum clinical content to an external model provider established abroad; details are in the KVKK notice.
Certificates
MTY's certificates
The seven ISO certificates below were issued for MTY, the company that develops VetBis. They cover MTY's software development activity and are not a certificate for VetBis's hosting infrastructure.
- Certification body
- BELCERT International Certification Company (ILAS accredited, ILAS-MS-0089)
- Name on the certificates
- MTY Marka Tasarla Yazılım ve Otomasyon Hizmetleri San. Tic. Ltd. Şti. (the company's former name)
- Scope
- Computer programming activities
| Standard | Subject | Certificate no. | Issue date | Validity date on the certificate |
|---|---|---|---|---|
| ISO 9001:2015 | Quality management system | A1576000 | 28.01.2025 | 28.01.2026 |
| ISO/IEC 27001:2022 | Information security management system | A1576149 | 28.01.2025 | 28.01.2026 |
| ISO/IEC 20000-1:2012 | IT service management system | A1576150 | 28.01.2025 | 28.01.2026 |
| ISO 22301:2019 | Business continuity management system | A1576154 | 28.01.2025 | 28.01.2026 |
| ISO/IEC 12207:2010 | Software life cycle processes | A1576152 | 28.01.2025 | 28.01.2026 |
| ISO/IEC 25010:2021 | Software quality model | A1576153 | 28.01.2025 | 28.01.2026 |
| ISO/IEC 33001:2015 | Software process assessment | A1576151 | 28.01.2025 | 28.01.2026 |
KVKK
Our approach to KVKK
KVKK is a legal obligation, not a certificate. That is why we do not use phrases such as "KVKK certified".
The clinic's role
For the personal data of pet owners, the clinic is the data controller. Preparing the privacy notice and, where required, registering with VERBİS are the clinic's obligations.
VetBis's role
VetBis processes this data on the clinic's behalf. The product helps the clinic meet its obligations with tools such as access control, audit logs and channel-based consent.
Legal texts
The privacy notice, the privacy policy and the personal data processing policy are published on separate pages.
SLA and status
Service level and system status
The contract commits to no uptime percentage or service credit, and we do not publish one on this page. The continuity approach is described on its own page.
For security questions
If you have a question about security or data protection, write to us through the contact page. You can ask for the written information you need before signing.
Go to the contact page
Frequently asked questions
An ISO/IEC 27001:2022 Information Security Management System certificate has been issued for MTY, which builds VetBis (certificate no. A1576149, BELCERT). The certificate belongs to MTY's software development activity, not to the hosting infrastructure. The validity date on it is 28.01.2026 and has passed; until a renewed certificate is verified we do not state a current validity.
Not by default. Each user is given the branches they can reach, and the system also separates records by clinic and branch.
Clinic and client records belong to your clinic. VetBis processes them on your behalf and lets you export client and patient records as CSV or XLSX.
KVKK is a legal obligation, not a certificate. The product provides tools such as access control, audit logs and channel-based contact consent. As the data controller, preparing the privacy notice and, where required, registering with VERBİS are the clinic's responsibility.
We do not publish a backup frequency or an uptime percentage on this page, because we do not want to write an unmeasured figure as a commitment. You can reach us during the contract process for written information.
We make no firm statement on this page about the hosting location; you can ask for written confirmation. The AI assistant is off by default; if a clinic administrator approves the separate notice and switches it on, the minimum necessary clinical content (without the pet owner's name and phone) is sent to an external model provider abroad. Service providers are used for email and SMS notifications. Details are in the KVKK notice.
On this page we list only the certificates for which we hold a copy of the document. If another certificate is shown, it will be added here separately.