What Is a Document Management System? A Corporate Guide to ISO 9001-Compliant Quality and File Control

What is a document management system?

A document management system is software that stores a company's documents in a single hierarchy and records every action. The quality manual, procedures, contracts, personnel records and audit files live under one roof.

It is abbreviated DMS. Quality teams often search for "quality document management" or "file tracking system". All of these describe the same need: find the document, use the right version and see who did what.

The biggest difference from a shared folder is the audit trail. When a document is deleted or overwritten in a folder, nobody notices. In a document management system every version, approval and access is recorded with a timestamp.

Three weak points of the shared folder

First, no trail. In a shared folder nobody knows who changed a document; in an audit the question "who approved this revision" goes unanswered.

Second, fake files get in. Ordinary systems only look at the extension. When an executable disguised as a PDF lands in the folder, the door to ransomware is open.

Third, audit stress. Before an ISO audit, folders are tidied by hand, old versions are hunted down and destruction records cannot be found. The team spends days preparing.

What does an ISO 9001 audit ask for?

ISO 9001:2015 requires control of documented information. In practice that means revision tracking, controlled distribution, an approval flow and withdrawal of obsolete documents.

ISO 27001 adds role-based access and access logs on the information security side. ISO 15489 governs records management: legal retention periods, non-deletability and timestamps.

KVKK and GDPR add rules such as masking and the right to be forgotten for documents containing personal data. In healthcare and finance, HIPAA and BDDK regulations come into play as well.

A good document management system should carry these rules as ready rule sets, not as add-on modules. When the auditor arrives, a traceability report should be one click away.

How Filezonia works

Filezonia is the corporate quality and document control system we develop at Piküp Medya. It lives at filezonia.com, with the product page at pikup.tr/filezonia. Version 1.0 is in use.

Security is the foundation of the architecture. The first bytes of every upload are read and cross-checked against the extension; executable code disguised as a PDF or DOCX is blocked before it is written to disk. This is called a magic-byte check.

Every document action, session and permission change is chained to the HMAC SHA-256 digest of the previous record. A retroactive change breaks the chain and the system raises an alert. Even a database administrator cannot delete records without a trace.

The ISO 15489 WORM archive calculates legal retention automatically for financial and legal records; nothing can be deleted before expiry. In litigation a one-click Legal Hold applies, and at the end of the period a committee-approved digital destruction record is produced.

On the usage side everything is drag and drop: moving branches in the folder tree, dropping multiple files from the desktop, approving or rejecting on a Kanban board. The sector is chosen at setup; the ISO folder tree and document code template arrive automatically for healthcare, finance, manufacturing, construction, logistics, legal, holdings and SMEs.

On compliance, ready rule sets are built in for ISO 9001:2015, ISO 27001:2022, ISO 15489-1, KVKK/GDPR, ISO 45001 and 14001, and BDDK/HIPAA. Logo, colours and company name are applied as white-label branding at setup.

Where is the data kept?

Filezonia does not run in a shared cloud pool. Each company gets its own isolated server: in Piküp Medya's high-security data centre or, if preferred, on the company's own server.

The stack is built on isolated Docker containers, PostgreSQL 16 and MinIO S3-compatible object storage. WORM protection is enforced at the storage layer, and duplicate copies of the same file are deduplicated.

Before go-live the system goes through a penetration test with port scans, brute force and SQL injection scenarios. Administrators and users then receive live training, and a detailed user manual is provided as PDF.

The investment model: no per-user fees

Many document management solutions charge a monthly licence per user; the bill multiplies as the team grows. Filezonia uses a three-step model instead.

In the first year, setup and the software licence are paid once. Unlimited users and departments and all modules are included. When the team grows from twenty to five hundred people, no extra invoice follows.

In the following years only a fixed annual fee is paid, covering hosting, daily backups, the security shield and continuous development. There is no public list price; file volume and user structure are analysed and a tailored quote is presented within 24 hours.

The process has three steps: needs and security discovery, isolated setup and penetration test, go-live and training. All of it is delivered turnkey by the Piküp engineering team. You can request a discovery and demo meeting at pikup.tr/randevu.