Skip to content
Kulular Teknoloji, Kulular Bilişim Teknolojileri Limited Şirketi

Index

Ways of Working

Know what you get before you ask for a quote.

Seven defined ways of working. Each states its duration, the outputs delivered, the client's responsibility and the criterion for acceptance.

01

Compliance Control Prototype

We select one regulatory duty and turn it into a working control with an audit trail. The result is running code, not a report.

For

Organisations with an existing product that want a compliance duty connected to the running system

Client responsibility

Access to the existing system and a named process owner are provided by the client organisation.

Duration

Six weeks

Deliverables

  1. 01A provision matrix: which rule, in which process, in which data field
  2. 02A data-flow map and a retention-period table
  3. 03A working control component and its source code
  4. 04An audit-trail schema with sample records
  5. 05A responsibility table and a handover record

Acceptance criterion

Shown through an acceptance test: the chosen duty is enforced and produces a record at run time.

02

Auditable AI Workflow

We write how a model output was produced, who was responsible, and how a challenge is answered into the system's own record.

For

Organisations using, or preparing to use, AI, who need to be able to show the basis for a decision

Client responsibility

The choice of model or provider is made jointly with the client. Training data is supplied by the client.

Duration

Eight weeks

Deliverables

  1. 01A model card and data-provenance record
  2. 02A defined human-review point and its interface
  3. 03Risk classification and threshold calibration
  4. 04A decision-record schema: input, version, rationale and human decision
  5. 05A challenge workflow and response template

Acceptance criterion

For ten randomly selected decisions, the basis for each can be shown end to end.

03

R&D Project File

We turn a project idea into a file whose R&D character can be defended. We state where the uncertainty lies and how it will be measured.

For

Organisations applying to TÜBİTAK, KOSGEB or European programmes that need a file where the technical and legal sides are built together

Client responsibility

The applicant is the client organisation. Meeting eligibility conditions is the client's responsibility.

Duration

Four weeks

Deliverables

  1. 01A definition of the R&D uncertainty and its position in the literature
  2. 02A method design and measurement plan
  3. 03Work packages, a schedule and a draft budget
  4. 04An intellectual-property and data-access plan
  5. 05A draft application form

Acceptance criterion

The file can be defended point by point against the evaluation criteria used by reviewers.

04

Data Inventory and Compliance Map

We first work out which personal data is held in which table, for what purpose and on what legal basis. The notice and retention period are written after that inventory, not before it.

For

Organisations that do not clearly know which data they hold where, and whose data-protection notice was inherited from a template

Client responsibility

Access to the database schema and time from process owners for interviews are provided by the client.

Duration

Five weeks

Deliverables

  1. 01A data inventory table that also records physical location
  2. 02A legal-basis match for every data category
  3. 03A retention period and the design of the component that enforces it
  4. 04A draft notice derived from the inventory
  5. 05Identification of the sub-processor chain and any cross-border transfer

Acceptance criterion

The first question an audit asks, where the data physically sits, can be answered directly.

05

Software Contract and Acceptance Criteria Setup

The contract is not written by lawyers alone, it is built together with engineering. Acceptance testing, source-code ownership and change management become workable from the outset.

For

Organisations about to enter a software procurement, or already mid-development, who want the delivery dispute settled in advance

Client responsibility

The client's technical team is expected to take part in contract negotiation on the engineering side.

Duration

Three weeks

Deliverables

  1. 01A runnable list of acceptance tests and the environment they run in
  2. 02Intellectual-property transfer and licence scope set out clause by clause
  3. 03A change-request process and an impact-calculation method
  4. 04Fault classification for maintenance and support
  5. 05A data-processor clause where that relationship exists

Acceptance criterion

The moment of delivery becomes a sentence defined by which test passed, not open to argument.

06

Existing-System Audit and Modernisation Roadmap

We extract the system as it actually is: data model, access rights, integrations, security gaps. Then we set out which parts need to change, in a prioritised order.

For

Organisations looking to scale an old system, move from spreadsheets to a proper database, or simply get clarity on what works and what doesn't

Client responsibility

Read access to the existing system and time from relevant technical staff for interviews are provided by the client.

Duration

Four weeks

Deliverables

  1. 01A schema of the existing architecture and data model
  2. 02Security and access-rights findings
  3. 03A prioritised modernisation roadmap
  4. 04A data-migration plan, including where existing records will go
  5. 05Work packages alongside a cost and time estimate

Acceptance criterion

Every step of the roadmap is written so that which risk it reduces, and what counts as its completion, is clear.

07

Personal Data Breach Response Plan

Before a breach happens, we connect detection, classification, Board notification and data-subject notification into a working flow. The 72-hour window is measured by a drill, not discovered during the incident.

For

Organisations that process personal data and have left what to do during a breach to memory, not to a document

Client responsibility

The internal communication chain between IT, legal and senior management is defined by the client.

Duration

Three weeks

Deliverables

  1. 01A breach classification standard and a severity table
  2. 02The technical design of the detection flow: log source, threshold, alert
  3. 03A Board notification template and a 72-hour timeline
  4. 04A draft data-subject notification text
  5. 05A drill scenario and a post-incident record form

Acceptance criterion

Shown through a drill scenario: the time from detection to Board notification does not exceed 72 hours.

Write to us even if your problem does not fit any of these seven.

These formats are defined versions of needs we see often. We also carry out work whose scope we define together. In the first meeting, we put in writing what you will receive and what we will deliver.

Request a meeting