Kooch logo containing a shirdal inside a shield with kooch text

About Kooch

Kooch helps foreign companies, startups and SMEs navigate KVKK, VERBİS, GDPR and ISO/IEC 27001 through scoped, bilingual privacy and information security consulting.

Architecture pattern

Our Story

Kooch Cybersecurity & Compliance was founded in Istanbul in 2025 by Masoud Salmani, a cybersecurity analyst and entrepreneur.

Masoud saw that many startups expanding into Türkiye struggled with the complexities of local data protection law (KVKK) and its overlap with GDPR. Non-compliance wasn’t just a legal risk — it was blocking market entry and costing businesses opportunities.

Kooch was created to solve this problem: practical, productized compliance packages that help businesses register in VERBIS, meet regulatory requirements, and build trust with customers.

Why Choose Kooch?

Specialized in Türkiye & EU
Focused experience in KVKK, GDPR and ISO/IEC 27001 supports practical, scope-led compliance work, with legal questions escalated where needed.
Startup-friendly approach
Clear deliverables, responsibilities and dependencies designed for fast-moving teams; fees and timing are confirmed for the agreed scope.
Risk-focused mindset
We connect documentation to operating controls so teams can identify and address privacy, security and governance risks.
Global mindset
Bilingual Turkish and English delivery for international firms entering Türkiye, grounded in local regulatory processes and cross-border operating needs.
Founder-led expertise
Direct access to senior consultants and hands-on support, not just junior staff.
Lean and transparent
We use proven SOPs, cloud tools, and clear deliverables so you always know what’s happening and why.
Modern architecture details

Meet Our Founder

Masoud Salmani Founder & Principal Consultant

Masoud is a results-driven cybersecurity analyst with expertise in network security, cloud security, and incident response. He has previously founded and ran software ventures, built custom mobile and web platforms, and led cross-border projects.

That security and engineering background is what lets Kooch translate KVKK and GDPR from legal text into changes your developers can actually ship.

Certifications include:
- CompTIA Security+
- CompTIA Network+
- ISC2 Certified in Cybersecurity (CC)
- Microsoft Azure Fundamentals (AZ-900)

Languages: Persian (native), English (fluent), Arabic & Turkish (intermediate).

Architecture pattern
Modern architecture details

Our Mission & Vision

Mission: To make privacy and information security work practical and understandable for startups and companies expanding into Türkiye. Vision: To be a trusted boutique consultancy for cross-border privacy, security and market-entry compliance in Türkiye.

Modern architecture details

What We Do

KVKK Startup Launchpad
Scoped KVKK readiness support, including VERBİS work where registration is required.
GDPR/KVKK Gap Analysis
Evidence-based assessment of agreed practices, documentation and risks.
ISO 27001 Readiness
ISMS design, evidence and readiness support for independent certification.
Ongoing Compliance Management
Advisory compliance support and year-round oversight.
Data Controller Representative (KVKK) in Türkiye
Türkiye-based representative support for foreign controllers required to register with VERBİS.