Guides
Step-by-step guides on corporate email, file management and digital security.
- Security
What is CEO fraud? A guide to protecting against fake IBAN emails
CEO fraud is an email scam in which an attacker posing as an executive or supplier convinces an employee to make an urgent payment or pay a fake IBAN. The attacker wants the payment redirected to another account. These emails often carry no malicious link or attachment, so they easily pass through standard spam filters.
6 min read - Security
How to spot a fake invoice email: a checklist for accounting teams
A fake invoice email is identified by checking the sender address, attachment, amount and bank details against independent records. These emails appear to come from a genuine supplier and report an unpaid invoice or changed payment details. The goal is to redirect the payment to the attacker's account or get the malicious attachment opened.
6 min read - Compliance
KVKK email retention period and corporate document retention: key principles
KVKK does not set a single fixed period for email retention; personal data is kept for the period required by applicable legislation or by the purpose of processing. This guide summarizes the basic principles of access, retention, deletion and recordkeeping for corporate email and files as general information; it is not legal advice.
6 min read - Security
What are SPF, DKIM and DMARC? An email authentication guide for administrators
SPF, DKIM and DMARC are three DNS records that verify that emails sent on behalf of a domain actually come from that domain's owner. SPF defines the authorized servers, DKIM confirms the email wasn't altered, and DMARC determines what happens to mail that fails the check. Set up together, they make your domain much harder to impersonate.
6 min read - AI
AI in corporate communication: principles for safe and efficient use
AI in corporate communication is an assistant that summarizes correspondence, extracts information from attachments, drafts text and answers questions asked of documents. Used correctly, it shifts an employee's time from routine reading to decision-making. For this, the AI needs to operate within the person's own permissions and the data needs to stay within the organization's boundary.
6 min read - Security
Small business cybersecurity checklist: 20 essential measures
The small business cybersecurity checklist lists the measures that reduce the highest risk fastest with limited budget and staff. The 20 items below are grouped under accounts, email, files, devices, backup and employee awareness. Each item is written to be set up once and reviewed regularly.
6 min read - Administration
How to revoke email access for a departing employee? A step-by-step access revocation guide
A departing employee's email access should be revoked on their last day, their sessions ended, and their correspondence handed over to a colleague. Shared mailbox and file permissions are also revoked the same day. Being able to revoke access from a single list across all services removes the risk of a forgotten account.
6 min read - Security
The risks of sharing a shared mail password: how to use info@ and accounting@ addresses safely?
The biggest risk of sharing a shared mail password is not knowing who logged into the mailbox or who sent what. The more people a password circulates among, the higher the chance it leaks, a departing employee keeps accessing the mailbox, and everyone's work stops when the password changes. The solution is to use shared addresses with per-person permissions instead.
6 min read - Administration
What is the principle of least privilege? Applying it to email and file access in organizations
The principle of least privilege means giving each person and each system only the narrowest access needed to do their job, and no more. If an account is compromised or a mistake is made, the damage stays limited to what that account can reach. The principle is applied by granting permission based on job, role and department, and reviewing it regularly.
6 min read - Setup
Setting up corporate email for a new company: email and file infrastructure step by step
Setting up corporate email for a new company is four steps: register a domain, choose an email service, add DNS records, and open personal and shared addresses. Most of the steps can usually be completed within the same day, in a few hours. Setting up file organization at the same time makes it easier to manage access as the company grows.
6 min read - Identity
What is single sign-on (SSO)? Moving between corporate applications without re-entering a password
Single sign-on (SSO) lets an employee log in once and move between the organization's other applications without entering a password again. Set up correctly, it eliminates password fatigue and makes it possible to revoke access everywhere from a single place.
3 min read - Identity
What should a corporate password policy look like? A weak-password blocklist instead of complexity rules
A good password policy doesn't force "uppercase, digit, symbol"; it rejects known weak passwords, allows long passwords and limits failed attempts. This approach is both more secure and easier for employees.
3 min read - KVKK
What to do when an employee requests deletion of their personal data? A step-by-step KVKK deletion request guide
When a current or former employee requests deletion of their personal data, you need to log the request, verify the person's identity, separate what can be deleted from what must be legally retained, and respond with the outcome. This guide walks through the process step by step.
3 min read - AI
How to limit AI use in an organization? Per-person permission and monthly usage allowance
Opening up AI to everyone in the organization at once leaves both cost and data risk uncontrolled. Who gets to use it, what data they can access, and how much they can use need to be set from a single place.
3 min read - Administration
Managing multiple business applications from a single dashboard: people, departments and access in one place
When email, files, a website assistant and access control run on separate software, each keeps its own user list, its own permissions and its own invoice. A single dashboard lets you define a person once and grant access to every application from there.
3 min read