The two models in brief
| Topic | Cloud (SaaS) | On-premise |
|---|---|---|
| Cost structure | Recurring subscription; low upfront investment. | Upfront investment in licences, servers and database; annual maintenance. |
| Setup and upgrades | The vendor runs the infrastructure; upgrades follow the vendor's schedule. | Infrastructure and upgrades are your (or your partner's) responsibility. |
| Customisation | Usually limited to configuration; deep customisation is hard. | More room to customise; but every customisation makes upgrades harder. |
| Internet outage | The warehouse may lose access; offline capability is critical. | The warehouse runs as long as the local network does; ERP and external integrations may be affected. |
| Security and backups | The vendor's measures; to be verified through the contract and certificates. | Depends on your own IT processes. |
| Data location | The vendor's or hosting provider's data centre; the country should be written into the contract. | Your own servers; you control the data location. |
KVKK: holding data abroad
A WMS usually holds personal data such as customer names and addresses, recipient phone numbers and user details. If a cloud service's data centre is outside Turkey, this may amount to a transfer of personal data abroad. Article 9 of KVKK was amended by Law No. 7499, with the changes in force since 1 June 2024 [1].
- Adequacy decision: The Board may issue adequacy decisions for a country, sectors within it or international organisations; if one exists, the transfer can rely on it [1].
- Appropriate safeguards: Without an adequacy decision, one of the safeguards is needed, such as standard contracts, binding corporate rules or a written undertaking approved by the Board. Standard contracts must be notified to the Authority within five business days of signing [1][2].
- Incidental transfers: Without an adequacy decision or safeguard, a transfer is possible only in limited cases and on an incidental, non-regular basis [1]. The continuous data flow of a running WMS does not appear suited to this route.
This section is general information, not legal advice. Decide the legal basis for any transfer with your data protection adviser, and review the Authority's guide on transfers abroad [3].
Ask the vendor
- In which country and data centre is your data held? Where are the backups?
- Who are your sub-processors (hosting, support, email)? Do you notify us of changes?
- If there is a transfer abroad, what is its legal basis (adequacy decision, standard contract, etc.)?
- Can handhelds work offline during an internet outage? How is data synchronised when the connection returns?
- When the contract ends, in which format and within how many days is data returned?
- What is your monthly availability commitment and how is it measured?
A short decision guide
- Cloud stands out when internal IT capacity is limited, you want to start quickly with low upfront investment, and your processes are close to the standard product.
- On-premise stands out when you need deep customisation or automation integration, when the warehouse must run fully independently of internet outages, or when you want direct control over data location.
- Put the 5-year cost of both models side by side in the ROI / TCO calculator; for contract clauses see the contract guide.
Of the directory solutions, 4 mention both deployment options in their sources; for 20, the sources do not state a deployment model. Vendors can declare their data hosting location and KVKK processes in the directory listing form.
Sources
- Personal Data Protection Authority (KVKK), “Transfer Abroad” — kvkk.gov.tr (accessed: 2026-09-19)
- Personal Data Protection Authority (KVKK), “Standard Contracts” — kvkk.gov.tr (accessed: 2026-09-19)
- Personal Data Protection Authority (KVKK), “Guide on the Transfer of Personal Data Abroad” — kvkk.gov.tr (accessed: 2026-09-19)
Method and corrections: editorial policy.