Does giving logistics documents to AI breach KVKK?

Not in itself; but processing documents that contain personal data is subject to KVKK obligations. Settle data location, purpose and retention with your legal adviser.

Does GDPR also cover companies in Türkiye?

GDPR can apply to companies that process the data of people in the EU, depending on its scope. The scope depends on the company’s situation; ask your legal adviser.

Will an AI model be trained on my data?

That is a contract and architecture question and should be asked plainly before you buy. At Xontainer data stays with the company or is reserved for it alone.

Is a driver’s position personal data?

Yes, position information that makes a person identifiable can be personal data. The purpose and the retention period have to be defined.

AI in logistics and data security: a GDPR and KVKK view

Short answer AI in logistics and data security means protecting the trade secrets and personal data in shipping documents as they enter and leave an AI system. The core principles are: data stays with the company, companies cannot see each other, every AI call checks company and role, and a person approves critical steps.

Last updated: 2026-11-10 · Published by: Xontainer

What data is in logistics documents?

A shipment file holds commercial prices, customer and supplier names, addresses, vehicle plates and driver details. A driver’s name, phone and position are personal data. When AI reads these files it touches both trade secrets and personal data, so the legal frame has two sides.

What do GDPR and KVKK ask for?

In the EU the General Data Protection Regulation 2016/679 (GDPR), and in Türkiye the Personal Data Protection Law No. 6698 (KVKK), regulate how personal data is processed. Their shared ideas are that data must be processed for a specific and legitimate purpose, must not be collected beyond what is needed, must be protected, and must respect the rights of the person concerned. AI systems are not exempt. This guide is not legal advice; for your own situation ask your legal adviser and data protection officer.

Four architectural principles

Data stays with the company: processed documents sit on the company’s own server or on a server reserved for it alone.
Isolation between companies: one company cannot see another company’s records, and neither can the AI.
Authority on every call: each time the AI calls a tool, which company and which role it acts for is checked.
A limit on writing: the AI cannot write to pricing or customer master data; high-impact steps need a two-step human approval.

No person scoring is a data protection decision

A system that scores drivers or employees enters sensitive legal territory such as profiling and automated decisions. Xontainer has no person scoring; tachograph and position data are used to plan the trip, not to rank a person. This is both an ethical and a risk-reducing choice.

AI and traceability

When an AI suggestion is applied, the record should keep what the suggestion was, who approved it and when it was written. A rule without a source, or a guess written where “unknown” belongs, also damages traceability. A system that leaves a trail makes it easier to find the cause when something goes wrong.

What to ask when buying

Where is data processed? Is it an environment shared with another company?
Are my documents used to train a model?
As whom does the AI act on my behalf, and how do you check its authority?
What are the deletion and retention periods?
Is any person or employee scoring done?

For server options see the guide to on-prem GPU or a dedicated server.

Common mistakes

Pasting documents into a public AI service: trade secrets and personal data leave the company’s control.
Giving AI broad authority; a system with no role check on tool calls is risky.
Not asking about deletion and retention periods.
Trying to hand legal responsibility to software: responsibility sits with the company and the authorised person.

Sources

Frequently asked questions

Does giving logistics documents to AI breach KVKK?: Not in itself; but processing documents that contain personal data is subject to KVKK obligations. Settle data location, purpose and retention with your legal adviser.
Does GDPR also cover companies in Türkiye?: GDPR can apply to companies that process the data of people in the EU, depending on its scope. The scope depends on the company’s situation; ask your legal adviser.
Will an AI model be trained on my data?: That is a contract and architecture question and should be asked plainly before you buy. At Xontainer data stays with the company or is reserved for it alone.
Is a driver’s position personal data?: Yes, position information that makes a person identifiable can be personal data. The purpose and the retention period have to be defined.

Shall we talk about your own operation?

Leave a short note in the early-access form with your role and operation. The form is a prototype for now and sends nothing.

Early-access form