Compliance Overview
Lunixi is designed to be a compliance enabler — not just a risk tool. The platform is built on the assumption that your team will face regulators, auditors and legal review. Every decision is explainable, every action is traceable, and every configuration is documented.
The pages in this section describe where we are, not where we would like to be. If a certificate has not been obtained, we say so; if a capability does not exist in the code, we do not call it "coming soon". You need that to size your own compliance position correctly.
Standards and alignment
| Standard / framework | Where we stand |
|---|---|
| ISO 27001:2022 | Controls designed against the standard — certification in progress |
| PCI DSS v4.0 (Level 1 Service Provider) | Certification process under way |
| SOC 2 | Control set mapped to the criteria — no report issued yet |
| ISO 27701 | Privacy controls aligned — certification in progress |
| GDPR | Processing model documented, DPA available |
| KVKK | Technical and organisational measures implemented |
| MASAK | Sanctions list ingestion and procedural gates implemented |
| DORA · MAS TRM · FCA SYSC | Used as design input — an alignment claim, not an audit claim |
For detail and document requests, see Certifications.
Regulatory coverage
Audit trail
Every decision made by Lunixi is persisted as an immutable event with:
- The input data at the time of the decision
- All signal scores and verdicts
- The resulting action (
allow,review,hold,block) - Analyst overrides and notes
- Timestamps with millisecond precision
On the identity verification side the audit log is hash-chained: each row's digest is derived from its own content and the previous row's digest, so insertion of a record or re-linking of the chain is detectable.
Retention
Retention is not a single global number — it is resolved per data type and per jurisdiction.
| Data | Default period |
|---|---|
| Identity verification records (general) | 1825 days (5 years) |
| Identity verification records (Türkiye) | 2920 days (8 years) |
| Biometric images (Türkiye) | 90 days |
| Suspicious activity report records | 5 years |
Periods are overridable per installation. Automatic destruction is off by default and must be enabled per installation — for detail and the erasure endpoints, see KVKK.
Data residency
Data generated in Türkiye is hosted on our own infrastructure. Object storage and key management are not delegated to a third-party cloud provider; they run on infrastructure we operate.
Objects such as documents and biometrics are encrypted at the application layer with a per-tenant AES-256-GCM envelope before they are written to storage. This is a boot condition: if server-side encryption is not configured on the storage side, the service will not start unless application-layer encryption is enabled.
A capability, not a description of today's installation. A region-specific separate installation can be provisioned, with its own storage target and its own key management. If you need a written, binding statement of where your data sits in your installation, request it from [email protected]. We do not publish a region table on this page, because it varies per installation and a generic table would be misleading.
Law no. 6493 and TCMB
Licensing status — statement pending. Lunixi's status under law no. 6493 (payment institution / electronic money institution licence, operating permission, agency structure) is a corporate and legal statement; it is not something this page fills in from technical measurement. For the current position, email [email protected].
What is embedded in the code and verifiable is this: an e-money holder's right to redemption is unconditional, and the platform enforces that right as a constraint.
The clearest place this shows is employee offboarding on a corporate wallet. When an employee is removed from a corporate account:
- Their balance is untouched — the money belongs to the holder and remains spendable and withdrawable
- The user status stays active; it is not frozen (freezing would close every money-out path)
- No ledger entry is written and no balance is read
- The codebase contains no clawback, sweep or balance-transfer primitive, and a note explicitly records that none is to be added
- Card freezing is deliberately not wired in either, because it would amount to a soft clawback
An honest boundary: this is a non-forfeiture guarantee, not a dedicated "redemption" endpoint. The balance leaves through the ordinary withdrawal path. Additionally, account closure requires a zero balance — closure does not repay a remaining balance to the holder; the holder must withdraw first.
TCMB's regulation on remote identity verification is addressed through gates in the identity verification flow such as four-eyes (maker-checker) approval, framework-contract assent, uninterrupted session recording and operator question sets. Mapping those gates to specific regulatory articles is pending legal confirmation.
Questions
- Compliance configuration and screening coverage — [email protected]
- Data processing, DPA and residency statements — [email protected]
- Security documents and vulnerability disclosure — [email protected]