The data a property management holds is people’s names, phone numbers, units and debts. In MeskenPlus the most critical rules are not enforced by hiding things in the interface but by making them mandatory in the database.
Features labeled “On the roadmap” are in development; the others can be used today.
The rules live in the database; their result shows in the panel, in the records themselves. The screens use the data of the demo property Huzur Sitesi.
Every record, display of personal data and export in a property: who did what, when, and with what result. The audit trail cannot be changed or deleted.
The auditor signs in read-only. The portal checks the hash chain, ledger–bank agreement, expenses without documents, duplicate payments and payments split under the approval threshold on the records.
Requests from data subjects under KVKK (Turkish Personal Data Protection Law) to access, correct, delete or object are tracked against the 30-day legal deadline; a request past its deadline is flagged.
Permissions are given with a role, a scope and a validity date: organization, property, section or block. A job title is not a permission.
| Role | Sees | Does | Two-step verification |
|---|---|---|---|
| Organization owner | All of the organization’s properties | Everything; team, permissions and KVKK requests | Required |
| Property manager | The properties in their scope | Budgets, charges, collections, expenses and approvals | Required |
| Accountant | Ledger, reports and people | Journal entries, charges, collections, expenses and payroll | Required |
| Block or section manager | Only the units and people of their own block or section; not the ledger | Resident invitations, service requests, meter readings | Optional |
| Auditor | Ledger, records and audit trail | Only writes findings | Required |
| Board member | Ledger, budgets and decisions | Takes part in payment approval; cannot pay alone | Optional |
| Owner, tenant and resident | Only their own unit and their own period | Debts and receipts, announcements, polls, service requests; household members do not see debts | Optional |
| MeskenPlus team | Organizations’ metadata | No permission on the people, journal entry and document tables | Always required |
Each organization’s data sits in the same database, isolated from the others.
A row-level security rule runs on every table that belongs to an organization. The application connects with a separate database role that cannot bypass it.
If the request context has not been set, a query sees no rows at all; an error leads to an empty result, not to a data leak.
The MeskenPlus team’s administration tool sees organizations’ metadata; it has no permission on the people, journal entry and document tables.
Accounting records and the audit trail cannot be changed afterwards.
Updating or deleting posted journal entries and their lines is blocked by a database trigger. Corrections are made by reversal.
Every journal entry carries a hash of the one before it; inserting a record in between or changing one shows up in the chain check.
Management actions are written to a table that cannot be changed, with who, what, when, from which address and the result.
Sessions are short-lived; the browser never connects to the API directly.
After repeated wrong passwords the account is locked for a while; a request limit applies per address.
A short-lived access token, and a refresh token in a cookie only the server can read.
Required for the organization owner, property manager, accountant and auditor roles; with single-use recovery codes and a list of sessions.
Approval with a one-time code, and a notification, for payments and changes to bank details.
The property management is the data controller; MeskenPlus, as data processor, processes data only on the management’s instructions.
Debtors’ names, units and debts are never shown on a shared screen, notice board, bulk message or PDF.
At sign-up, the terms of use and the privacy notice are accepted with their version number and stored; commercial message consent is separate and optional.
Turkish ID numbers, phone numbers and IBANs are stored encrypted and masked on screen; revealing the full value requires a permission and is written to the audit trail.
A person’s access and deletion requests are tracked against their legal deadline; accounting records are not deleted, personal fields are anonymized at the end of the retention period.
Payments are made into the property’s own bank account. MeskenPlus does not collect, hold or pay out money; it only reads the transaction data. So the property’s money is never exposed to a third party’s risk.
How transactions arrive from the bankResident pays
Bank transfer / FAST
Personal payment reference in the description
Property’s bank account
Huzur Sitesi Yönetimi
TR•• •••• •••• •••• 0042
MeskenPlus records
Matches the transaction to the unit
Issues the receipt, settles the debt
At no point does the money pass through a MeskenPlus account.
The servers are in data centres in Türkiye. Each organization’s data is isolated at row level in the database; Turkish ID numbers, phone numbers and IBANs are stored encrypted.
No. The platform administration tool sees organizations’ metadata (organization, license, user account); it has no permission in the database on the people, journal entry and document tables.
Posted accounting records and the audit trail are never deleted or changed; corrections are made by reversal, with the reason and who made it. Personal data is anonymized with approval at the end of the retention period.
In management roles, signing in also needs a 6-digit code sent to your email or made by an authenticator app, and the account is locked after repeated wrong attempts. You can end sessions on other devices from “My sessions”; when the password changes, every session other than the current browser is ended.
Only authorized roles can export personal data; every page of the file is watermarked with the user and the time, and the export is written to the audit trail with the file’s hash.
Bring your security and KVKK questions to a demo, and we will look at them together on the panel’s own screens.