Last month I sat down with the general manager of a mid-sized packaging company in Izmir. The company wanted to manage its accounting and inventory from a single system, and the local reseller had proposed a software product hosted on the vendor’s own servers, accessed over the internet. The manager’s reaction was immediate: ‘There is no way I am putting my company’s data on someone else’s computer.’ That reaction is common among Turkish SME owners, and it is not unreasonable. But when you push on the assumptions underneath it, the picture turns out to be less straightforward than it first appears.
Internet-hosted software — where the application and its data live on servers operated by the vendor or a service provider rather than in the customer’s own office — is a relatively new proposition for Turkish SMEs. Larger enterprises have been evaluating this model for a few years, but in the SME segment the conversation is only just beginning. The core question is whether keeping data on-premises is genuinely safer than placing it in a professionally managed facility. Answering that question requires technical criteria, not gut feeling.
Start with a realistic look at the typical SME server room. In most cases it is a repurposed storage corner: inadequate cooling, a UPS that has not been tested in months, and a backup routine that runs only when someone remembers to run it. Physical access is often controlled by habit rather than a locked door with an access log. A fire, a flood, or a prolonged power outage could destroy the data entirely, and there is rarely a business continuity plan in place to address any of these scenarios. This is not a criticism — it is an accurate description of the average SME infrastructure in Turkey today.
A professionally operated data center works at a fundamentally different level. Redundant power systems, climate-controlled server halls, around-the-clock monitoring, strict physical access control, and documented backup procedures represent a standard that most SMEs simply cannot replicate on their own. Because the facility operator spreads these costs across many customers, the per-customer price remains manageable. So the real question shifts from ‘am I giving my data to a stranger?’ to ‘is this particular service provider genuinely trustworthy?’
That is the right question, and there are concrete criteria for answering it. First, ask where the data physically resides and what infrastructure certifications the facility holds — is the data center located in Turkey, and what security standards govern its operations? Second, clarify the backup policy: how often are backups taken, are they stored in a separate physical location, and has a restoration test been performed recently? Third, ask about data encryption: is data encrypted in transit over the internet, and is it stored in encrypted form on the server? Fourth, read the service contract carefully — if the provider goes out of business or discontinues the service, how do you retrieve your data and in what format? A provider that cannot give clear written answers to these four questions may well represent a greater risk than your imperfect server room.
Internet connectivity is a separate variable worth addressing honestly. ADSL is spreading across Turkey, but connection outages are still a regular occurrence. If your software lives on a remote server, you cannot access it without an internet connection — a vulnerability that does not exist with an on-premises setup. This limitation should not be overstated, however. Most accounting and inventory workflows can absorb a few hours of downtime without serious damage, and local data exports can serve as a fallback for critical information. Connectivity reliability is not a reason to walk away from the evaluation; it is a technical requirement that should be written into the service agreement.
For an SME manager working through this decision, a practical framework looks like this: first, assess your own server room honestly — when did you last take and verify a backup? Then send the four questions above to the service provider in writing and insist that the answers appear in the contract. Security concern is a legitimate concern, but the right response is to use it as a tool for asking better questions, not as a reflex reason to say no. Data security is not a feeling; it is an auditable process, and any serious provider should be able to demonstrate that process on paper before you sign anything.
This article was originally written in Turkish by Gökhan MERCANOĞLU on April 14, 2008 and has been automatically translated into English and other languages using machine translation.