For Law-5651 compliance, both a hardware appliance and a software/virtual machine (VM) solution are valid choices; the law does not mandate a specific product form, it requires that log records stay tamper-proof and are retained with a timestamped signature. SignLogger is a software/VM solution that runs on your own server, so your data stays on your infrastructure.
This content is general information and does not replace legal advice. For your compliance obligations, rely on the current text of the regulation and a qualified expert.
What Is an Appliance vs. a Software/VM Approach?
A hardware appliance arrives as a closed unit preloaded on the vendor's own box. It is relatively quick to install, but its capacity, interface, and update schedule depend largely on the vendor. In the software/VM approach, the solution runs as a virtual machine in your own VMware or Hyper-V environment; you manage the hardware, backups, and scaling.
The essence of 5651 compliance is product-independent: collecting access and transaction logs, guaranteeing they are not altered, and retaining them with a timestamp. SignLogger signs these records every day with a timestamp and e-signature from the authorized certificate authority TÜBİTAK Kamu SM; the Kamu SM service works with credits (kontör). For details, see the Law-5651 log signing solution page.
Appliance vs. Software: Comparison Table
The table below summarizes the two approaches across core criteria in a neutral frame. The right choice depends on your organization's size, existing virtualization stack, and internal resources.
| Criterion | Hardware Appliance | Software / VM |
|---|---|---|
| Upfront cost | Usually higher, hardware included | Lower when virtualization already exists |
| Flexibility | Limited to the box, fixed build | Resources (CPU/RAM/disk) tuned to need |
| Scaling | May require buying a new box | Often just increase VM resources |
| Updates | Tied to vendor schedule and hardware lifespan | Continues via software updates, not bound to hardware life |
| Vendor independence | Higher risk of ecosystem lock-in | Works with any RADIUS-capable firewall |
| Data location | On the device; depends on vendor model | On your own server, data stays on-prem |
| Backup / disaster recovery | Device backup planned separately | Included in standard VM snapshot and backup routines |
Which One Fits Which Situation?
- If you already have a virtualization stack (VMware/Hyper-V) and your IT team manages VMs, software/VM is usually more economical and flexible.
- For small sites with no server environment that want a turnkey single-box install, a hardware appliance can be practical.
- If you expect growth, multiple branches, or a variable user count, the scaling advantage of the software side stands out.
- If you run firewalls from different brands, a vendor-independent software solution avoids lock-in.
SignLogger deliberately sits on the software/VM side: it is vendor-independent, works with any RADIUS-capable firewall, and runs on your own infrastructure so your data stays on-prem. This also lets you stay compliant in hotspot and captive portal scenarios without replacing your existing network gear.
Points to Weigh When Deciding
- Total cost of ownership: include hardware refresh, maintenance, and potential lock-in.
- Log signing model: how the timestamp and e-signature process works, and how credit (kontör) consumption is planned.
- Retention period and capacity: securely holding data for the period the regulation prescribes.
- Corporate policy: whether data must remain in your own data center rather than in the cloud.
Frequently Asked Questions
Is a hardware appliance mandatory for 5651 compliance?
No. The law does not require a specific product form; what matters is preserving record integrity and retaining logs with a timestamped signature. This can be achieved with either a hardware appliance or a software/VM solution.
Is a software solution as secure as hardware?
Security comes from the process, not the product form. With daily Kamu SM timestamp and e-signature signing, access control, and regular backups in place, a software/VM solution meets enterprise security requirements.
Which side does SignLogger fall on?
SignLogger is a software/VM solution. It runs in your own VMware or Hyper-V environment, is vendor-independent, and keeps your data on-prem on your own infrastructure.
How does log signing work?
SignLogger signs collected logs every day with TÜBİTAK Kamu SM's timestamp and e-signature. Because this service works with credits (kontör), credit planning is considered during setup.
Do I need to replace my existing firewall?
Usually not. SignLogger is vendor-independent and works with any RADIUS-capable firewall, so in most scenarios your existing network infrastructure is preserved.
What is the cost of moving to a software solution?
If you already have virtualization, the added hardware cost typically disappears. Total cost varies by organization depending on VM resources, retention capacity, and credit usage.