Law 5651: official requests, legal holds and export procedure
When a letter from a prosecutor, police or court arrives, record the request, put the affected days on legal hold, produce and verify an evidence ZIP and hand it over.
This guide continues Law 5651 records: read how records are collected there. Here are the steps to follow when an official letter arrives.
Roles
For Law 5651 records the business (the customer) is the data controller and Hotspotly is the data processor. The customer records the official request and takes the legal export. A reseller sees records read-only, cannot open requests and can only take masked exports. The platform administrator handles requests only for official requests and operations, with every access audited.
Procedure
- Record the request. On Log → Legal requests press Record official request. Fill in Authority (prosecutor, police, court), Reference number and Letter date.
- Protect the days. Leave Add a legal hold for these days (not destroyed) ticked for the days the letter covers. Days under legal hold are not destroyed even when the retention period ends.
- Careful with notes. Do not write personal data such as an ID number or phone number in Note; use it for internal tracking only.
- Export. On the request row press Export for this request; set the range with Start day and End day (inclusive) and, if needed, an internal IP or MAC filter. A legal export contains full identities.
- Wait. The job runs in the background (Queued → Preparing → Ready). You can have at most 3 export jobs at a time.
- Download. Download creates a single-use link valid for 5 minutes. The file is deleted from the server after 7 days and can be produced again if needed.
- Verify (below) and hand the ZIP to the authority together with the SHA-256 shown in the panel.
- Close. Set the request status to Fulfilled. When the case or investigation is over, remove the hold with Release hold; those days return to the normal retention rule the following night.
Request statuses: Received, In progress (set automatically once an export is linked), Fulfilled, Rejected and Cancelled. A closed request cannot be reopened; record a new one.
What the ZIP contains
| File | Contents |
|---|---|
events.csv |
Access events (UTC and Istanbul time; internal IP, MAC, identity) |
sessions.csv |
Sessions overlapping the range |
seals/<day>/… |
Daily seal manifest and Merkle proof; in a legal export also the sealed day file |
tsa/<day>/batch-N.tsr |
Timestamp response |
README_DOGRULAMA.md, dogrula.sh |
Verification instructions and script |
SHA256SUMS, export-manifest.json |
File hashes, record counts and the complete flag |
Visited websites, destination IPs and communication content are not recorded and are not part of the export.
Verification
The output must end with SONUC: TAMAM ("RESULT: OK"), and export-manifest.json must contain
"complete": true. If the panel shows the Missing evidence badge, the manifest
names the reason:
- The range contains a day that is not sealed yet (today, or the nightly seal job has not run): export again the next day.
- A day is waiting for its timestamp: export again once the timestamp service is active.
Requests that only give a public IP
If the letter only gives a public IP and a time, you first need to find which customer used that IP. The platform administrator does this with the Reverse lookup by public IP card (time in Turkish local time, ±15 minutes tolerance by default). For the customer and device found, follow the procedure above with an internal IP / MAC filter. Matching is easier when the customer declares fixed public IPs in the compliance profile.
Audit trail
Every export request and every download is written to the access audit together with who did it. Official request and legal hold actions go to the audit logs (note texts are not written).