Turkey's KEP System: How Registered Email Creates Legally Binding Digital Evidence

#legal #email #security #turkey

In Turkey, a regular email has zero legal standing in court. But a KEP (Kayıtlı Elektronik Posta — Registered Electronic Mail) message is as binding as a notarized document. Here's the technical architecture behind it.

What is KEP?

KEP is a government-regulated electronic mail system where every message generates 6 cryptographic evidence records:

Evidence Type	Turkish Name	When Generated
Submission	Gönderi Delili	Sender clicks "Send"
Acceptance	Kabul Delili	KEP server accepts the message
Dispatch	Sevk Delili	Message leaves sender's KEP provider
Delivery	Teslim Delili	Message arrives at recipient's inbox
Read	Okundu Delili	Recipient opens the message
Error	Hata Delili	Delivery fails

Each evidence record is digitally signed with the KEP provider's qualified certificate and timestamped with an RFC 3161 timestamp.

The 5-Day Rule

Under Turkish law (Tebligat Kanunu 7/a), if a KEP message is not opened within 5 days of delivery, it is legally deemed "served" (tebliğ edilmiş) on the 5th day. This is critical for:

Court notifications (UETS)
Tax assessments
Employment terminations
Contract cancellations

Day 0: Message delivered to KEP inbox (Teslim Delili generated)
Day 1-4: Recipient hasn't opened it
Day 5: Legally served — clock starts on response deadlines

KEP vs Regular Email vs UETS

Feature	Regular Email	KEP	UETS
Legal standing	None	Full (HMK 205)	Full (Teb. K. 7/a)
Evidence generation	No	Yes (6 types)	Yes
Who can send	Anyone	Licensed providers	Courts & gov only
Timestamp	No	RFC 3161 qualified	Yes
Storage obligation	None	20 years	10 years
Cost	Free	~₺200-500/year	Free for recipients

Technical Architecture

┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│   Sender's   │    │  KEP Provider │    │  Recipient's │
│   KEP Client │───▶│   (ESHS)     │───▶│  KEP Inbox   │
└──────┬───────┘    └──────┬───────┘    └──────────────┘
       │                   │
       │            ┌──────▼───────┐
       │            │  Timestamp   │
       │            │  Authority   │
       │            │  (RFC 3161)  │
       │            └──────┬───────┘
       │                   │
       ▼                   ▼
  ┌────────────────────────────┐
  │    Evidence Records (ASN.1) │
  │    Signed + Timestamped     │
  │    Stored for 20 years      │
  └────────────────────────────┘

The KEP provider (ESHS — Elektronik Sertifika Hizmet Sağlayıcısı) acts as a trusted third party, similar to how Certificate Authorities work in TLS.

Developer Integration

Some KEP providers offer SOAP/REST APIs for programmatic sending:

# Pseudocode for KEP API integration
import requests

kep_api = "https://api.kepservisi.com/v1/send"
payload = {
    "from": "firma@hs01.kep.tr",
    "to": "muhatap@hs02.kep.tr",
    "subject": "Fesih Bildirimi",
    "body": "İş akdiniz ... tarihinde feshedilmiştir.",
    "attachments": [{"name": "fesih.pdf", "base64": "..."}],
    "sign_with": "e-imza"  # Requires qualified certificate
}
response = requests.post(kep_api, json=payload, cert=("client.pem", "key.pem"))
# Returns: delivery_id, submission_evidence_url

Why This Matters for LegalTech

If you're building legal software for the Turkish market, KEP integration is not optional — it's mandatory for any application handling:

Employment contracts and terminations
Invoice disputes (8-day objection period)
KVKK (GDPR equivalent) data subject requests
Commercial lease notifications

📎 Our open-source tools: github.com/eimza-kep

DEV Community