Got a Docker Compose file? Your project goes live in seconds — one command on cdn.com.tr. See how Built your app with AI? From folder to live URL with one command — no git, no registry: cdnctl deploy. See how Code on GitHub? Every push auto-deploys to cdn.com.tr — connect your repo and ship. See how Start free trial

CDN.com.tr Help

Türkiye-only processing: frequently asked questions

The most common questions about contract-based Türkiye-only processing: where your traffic is processed, DNS options, origin protection and logs.

Billing, packages, and invoices

Türkiye-only processing: frequently asked questions

The most common questions about contract-based Türkiye-only processing: where your traffic is processed, DNS options, origin protection and logs.

Use cases

A company whose data must not leave Türkiye under KVKK wants answers to its technical and contractual questions before choosing a CDN and WAF provider.

Workflow

  1. Contact us for the Enterprise plan; Türkiye-only processing is offered there, under contract.
  2. Review and accept the agreement package (Order Form, Terms of Service, Data Processing Agreement, SLA, Sub-processors, Security Measures).
  3. Your account is added to a cluster made only of edge servers in Türkiye; we test your site together without touching DNS.
  4. Point the root domain and www at the addresses we give you, or move your DNS to our name servers in Türkiye.

Checks

  • TLS termination, WAF inspection, caching and logs run on edge servers in Türkiye; the commitment is written in Data Processing Agreement clause 9.2 and Annex 4.
  • Traffic is not rerouted abroad during an attack or an outage.
  • The setting is switched off only on your written instruction.

Frequently asked questions

Is my traffic rerouted abroad during an attack or an outage?

No. The cluster has no edge server abroad and traffic is not rerouted to points outside Türkiye; this is written in Data Processing Agreement clauses 9.2 and 9.7.

Where is this commitment written in the contract?

The Order Form shows the Türkiye-only setting switched on. Data Processing Agreement clause 9.2 and Annex 4 state in detail that traffic is processed only in Türkiye.

Does my traffic pass through your Multi-CDN product or a provider abroad?

No. While Türkiye-only is on, global delivery, foreign clusters and foreign edge servers cannot be switched on (Data Processing Agreement Annex 4); the only sub-processors used are data centre operators in Türkiye.

Can I keep my DNS at my current provider?

Yes. A records to our edge addresses for the root domain, and an A record or a CNAME target of your own for www, are enough; only our name servers in Türkiye answer for the CNAME target. If you prefer, import your DNS in the panel and switch your name servers to ours in Türkiye (atlas.ns.cdn.com.tr, iris.ns.cdn.com.tr).

What is the request timeout to the origin?

60 seconds by default; it can be set per path from 1 to 3600 seconds.

Which header carries the real visitor IP?

X-CDN-Client-IP; the source port comes in X-CDN-Client-Port. Our edge writes these headers itself on every request, and headers of the same name sent by the visitor are ignored.

How do I open my origin only to traffic from you?

The addresses our edge servers use to connect to your origin are listed in your written Activation Notice; allow those addresses on your server. In addition, you can define a secret header (for example X-CDN-Auth) in your rules in the panel, which our edges add to every request, and reject requests without it.

Is a CAPTCHA service based abroad used for bot verification?

No. The JavaScript challenge runs on our own edge servers; the geolocation database is local to the edges too, and no IP is sent out.

Are request bodies logged?

No. Request bodies are not kept in any log; text sent through forms and file attachments never enter the logs. If you want, Logpush delivers a log of requests to you; these logs are kept in our storage in Türkiye for 30 days, and they are not created unless you turn Logpush on.

Is there a trial?

Contract-based Türkiye-only processing is part of the Enterprise plan: monthly, with no commitment. Instead of a trial, we test your site through our edges together before you change DNS.

Can I run the WAF rules in log-only mode first?

Yes. In the panel you switch the WAF to log-only for the whole site or for the paths you choose; the WAF writes the requests it would have blocked to the logs as "would have blocked" and blocks none of them. The mode returns to blocking by itself at the end of the period you pick (7, 14 or 30 days). IP, country and network lists, rate limits and the JavaScript challenge keep blocking in this mode.

Related pages

Buy or assign a package

Use package and cart screens to unlock account capacity before API, cdnctl, or AI-agent work starts.

Trial, refunds and going over your quota

Standard packages come with a 15-day risk-free trial. Your site is not cut off when the quota runs out. This page explains what counts toward the quota and what happens when it runs out.

In which countries your data is processed

Your object storage, your application's disks and your managed databases sit on servers in Türkiye, and your application runs on Turkish nodes. On request we also serve your traffic from Turkish PoPs only.