# Show your auditors the record, not a promise > Projects, hours and people in one product, with every privilege change on the record, access set by role down to the field, and the data kept where your regulator says it must be. - [Book a demo](https://akollo.com/en/demo) - [Read the docs](https://docs.akollo.com/en) ## How regulated teams set up and run Akollo The controls are part of the everyday work, so the evidence builds up while people plan, log hours and approve. 1. **Keep the data where the rules say** (Deployment) — Run Akollo in your own data centre, in your own cloud account or in our cloud. It is the same product in each, so the choice follows your policy, not the feature list. 2. **Give each person only the access they need** (Organisation and access) — Permission sets by role, and field policies that hide, mask or lock sensitive fields. Loosening a field policy waits for a second administrator. 3. **Record work with an approval behind it** (Time tracking) — Timesheets are approved by the right manager. A correction needs a reason and a second person, and the original record is never overwritten. 4. **Let AI help without letting data out** (AI connections) — Decide which level of data may reach a cloud model. Restricted data is answered only inside your installation, or not at all. 5. **Hand auditors evidence, not e-mail threads** (Governance) — Audit records of privilege and configuration changes, and access review results as CSV or Excel files with a checksum. ## The screens compliance and delivery teams share Delivery teams see their projects. Security, data protection and audit see the controls around them, from the same records. ### Portfolio overview Change, IT and regulatory projects with their health, budget and staffing, so the steering committee reads one screen. - Health and progress per project - Budget against actual cost - Who is booked where ### Audit records Every change to roles, permissions and settings, with who made it and when, ready to filter for the question in front of you. - Privilege and configuration changes - Who, what and when - Read by auditors and security ### Access review A campaign by unit, role, administrators, contractors or service accounts. Each item goes to a reviewer who is never the person themselves. - Keep or revoke, with a reason - Nobody reviews their own access - Results with a checksum ### Recording notice Your own notice telling employees what is recorded. Collection stays blocked until each person has read and acknowledged the current version. - Your words, in Turkish and English - Acknowledged per person - A new version asks again ## Where the rules decide how you run your projects Regulated organisations still run projects, book people and track hours. The difference is that every one of those steps may be asked about later. These are the teams Akollo is set up for. - **Finance and insurance** — Banks, insurers and payment firms running change, IT and regulatory projects on their own servers, with the audit trail internal audit asks for. - **Public sector** — Ministries, municipalities and agencies that need projects and working time without an outside cloud, and retention that follows the records policy. - **Healthcare** — Hospitals and health groups that keep staff and project data inside their own network, with sensitive fields hidden or masked by role. [How we protect your data](https://akollo.com/en/trust) ## Evidence you can pull on the day it is asked for Auditors ask who did what, who could see what and how long it was kept. The answers come from records Akollo keeps anyway. - **Who changed what** — Every change to privileges and configuration, with the person and the time, instead of a reconstruction from several systems. (Admin → Audit records) - **Access still in use** — Review campaigns show who decided to keep or revoke each access, and why. Results download with a checksum, and each download is logged. (Access reviews) - **Approved hours and corrections** — Which manager approved which week, and every correction with its reason and second approver, next to the original record. (Timesheets) - **Retention against the notice** — How long each kind of data is kept, and whether that matches the notice employees acknowledged. (Retention and deletion) ## AI that respects how your data is classified Akollo AI reads only what the person asking may see, never widens anyone's access, and asks before it changes a record. - “Which regulatory projects are behind schedule this quarter?” — Two of seven: the reporting upgrade is a week late and the archive project is waiting for a supplier. Shall I draft a note for the steering committee? - “Who logged time on the payments change project this month?” — Six people logged 186 hours, and every week is approved. I can break it down by person and week for the audit file. - “Plan this year's access review with owners and dates.” — Here is a plan in three phases with 11 tasks, owners suggested from security and HR, finishing before the year-end audit. Create the project? Restricted data is answered only by a model inside your installation, or not at all. Every AI request is logged with the model and usage, never the question or the answer. ## The Akollo modules regulated teams use most - [Projects & tasks](https://akollo.com/en/products/work) — Portfolios, projects and approvals. - [Time tracking](https://akollo.com/en/products/time) — Approved timesheets with a correction trail. - [Resource planning](https://akollo.com/en/products/people) — Capacity and skills across units. - [Budgets & profitability](https://akollo.com/en/products/finance) — Project budgets against real cost. - [Reports & dashboards](https://akollo.com/en/products/insights) — Portfolio health for the steering committee. - [AI assistant](https://akollo.com/en/products/ai) — Classification-aware, on your own model or off. ## Questions compliance and security teams ask ### Is Akollo certified, for example under ISO 27001 or SOC 2? We do not claim any certification. A control register that maps Akollo's controls to ISO/IEC 27001, BDDK and KVKK requirements is planned. It is a mapping your own assessment can start from, not a certificate. ### How does Akollo help with KVKK and GDPR? You publish your own recording notice and collect acknowledgement per person, restrict access by role and field, set retention per kind of data and run access reviews. Your data protection team sets the policy; Akollo makes it enforceable and leaves a record. ### Can security events go to our SIEM? Forwarding security events to a SIEM over syslog with TLS or Splunk HEC is planned. Today administrators and auditors read privilege and configuration changes in the audit records. ### Who at Akollo can see our data? Only someone in a support session, which your organisation sees as a banner. A support session can read the pages it is allowed to, but cannot create, change, approve or delete anything, and sensitive fields stay hidden. ### Can we start with one department? Yes. Many organisations start with IT or the PMO and add other units once the first one is live. Everything stays in one installation with one set of controls. ## Plan a pilot with your IT and compliance teams We will walk through deployment, access rules and the evidence your auditors expect, and agree a first unit to start with. - [Book a demo](https://akollo.com/en/demo) - [Read the docs](https://docs.akollo.com/en) --- Source: https://akollo.com/en/solutions/regulated-industries · [Türkçe](https://akollo.com/tr/cozumler/regule-sektorler), [Deutsch](https://akollo.com/de/loesungen/regulierte-branchen)