Your logs in the cloud, sealed hour by hour.
No server, no disks, no backups. Your FortiGate sends logs over an encrypted connection to the LogHane cloud; every hour is sealed, timestamped and kept in a delete-proof archive for as long as the law requires. When asked, you hand over a verifiable evidence package.
Download the technical brochure (PDF)- 09:00–10:00sha256 a3f1…9c02
- 10:00–11:00sha256 7be4…11d8
- 11:00–12:00sha256 c09a…e45f
- 12:00–13:00sha256 5d27…b3a0
- 13:00–14:00sha256 e81c…04f9
- 14:00–15:00open segment · sealed at 15:00
Illustration; values are examples.
Log retention without a server room.
LogHane is built cloud-first: the same sealing, timestamps and evidence package, without anything to install or maintain.
No server, no maintenance
No hardware, disks or backup plans. Updates, monitoring and archive management are on Marta Teknoloji.
No install, a few commands
Open an account and paste the syslog commands the panel prepares into your FortiGate. Your first segment is sealed when the first hour closes.
Delete-proof cloud archive
Logs live outside your building in object-locked storage. Fire, theft or ransomware on site cannot erase them, and nobody can delete them before retention ends.
Every branch in one panel
Each branch's FortiGate connects to the same account; pick a device and every screen narrows to it. You add new devices yourself.
Silent devices get noticed
Alerts for devices that stop logging, clock drift and broken chain links; unrecorded hours never slip by.
Private, encrypted connection
Devices send logs over TLS with a certificate issued to your organisation; logs without it are not written to your space. Each organisation's storage and access are separate.
The answer, the evidence and the report.
“Who used that IP at that time?”
NAT, DHCP, guest login and Active Directory records are joined in a single query. The answer comes as one sentence, with its sources.
Burned to CD, verified offline
The evidence package carries its own verifier so an expert can repeat all six checks on their own computer.
Silent devices get noticed
A device that stops sending logs raises an alert; unrecorded hours are the most common cause of non-compliance.
Reports come with charts
Seven built-in reports or your own; PDF, XLSX, CSV, delivered daily, weekly or monthly by email.
Pick your obligation; everything else follows.
Each organisation has an obligation profile. Retention period, whether a timestamp is mandatory and whether URLs are logged all derive from it.
Non-commercial mass-use provider
Companies, malls, schools, hospitals: anyone giving internet to staff or visitors.
730-day retentionCommercial mass-use provider
Cafés, hotels, internet lounges: businesses offering internet commercially.
730-day retentionHosting provider
Servers and services hosting other people's content.
730 days · timestamp mandatoryAccess and proxy provider
Internet service providers and proxy operators.
365 days · timestamp mandatoryFrom firewall to evidence file, one unbroken chain.
Every step is tracked from the moment a log leaves the device until it enters an evidence package. If a link breaks, the system raises an alert.
- 1
Collected
Syslog on 514/udp, 514/tcp or TLS on 6514. A queue buffer means nothing is lost during a database outage.
- 2
Identified
Devices are recognised by serial number, not IP. A new device waits for approval.
- 3
Sealed
Each hour closes a segment linked to the previous one. The daily Merkle root is timestamped.
- 4
Locked
Sealed segments are written in WORM mode; nobody can delete them before retention ends.
- 5
Queried
“Who used that IP?” is answered by joining NAT, DHCP and identity records.
- 6
Delivered
The requested period is packaged as ZIP or CD-ready ISO, with its independent verifier.
Everything compliance needs, and more.
Legal retention is where it starts. The same logs feed security analytics, reporting and guest internet.
Sealing and timestamps
Hourly hash chain, daily Merkle root, RFC 3161 timestamp.
Evidence package
ZIP or CD-ready ISO with an independent verifier.
Identity mapping
NAT, DHCP, hotspot and AD answer “who used that IP?”
Retention and destruction
Per-profile retention, WORM lock, destruction record.
Reports
7 built-in reports and a builder; PDF, XLSX, CSV, email.
Security analytics
Risk and anomaly, threat intel, rule advisor.
Guest internet
SMS-verified login, RADIUS and AD; KVKK privacy notice.
Archive storage
IDrive® e2, AWS S3, Azure, Google Cloud and MinIO; the lock is measured.
Cloud first; on-premises when logs must stay on site.
Both are the same software: same sealing, same reports, same evidence package. The only difference is who holds the server.
No server, no maintenance.
Open an account and connect your FortiGate. Updates, backups and monitoring are on us.
- Devices connect over TLS (6514)
- Archive kept in object-locked cloud storage
- Separate space and access per organisation
- Add new devices yourself from the panel
Logs never leave the building.
Installed on a single Linux server with one script; syslog stays on your LAN.
- Debian 12/13 or Ubuntu 22.04+, on Docker
- Optional second archive copy in cloud storage
- Failed updates are rolled back
Choose by number of FortiGates.
Every package includes the 5651 core (hourly sealing, timestamps, evidence package, destruction record) and 730-day retention. Log collection never stops, even if archive space runs out.
Tek
Single-site business, hotel, café, school.
- Live stream, log explorer, 7 reports
- Identity resolution and DHCP mapping
- Guest internet (SMS login)
Şube
Head office and a few branches.
- Everything in Tek
- Active Directory sync
- Report builder and scheduled reports
Kurumsal
Most chosenMulti-site organisations or those with a security team.
- Everything in Şube
- Risk and anomaly
- Threat intel and rule advisor
Zincir · MSP
Retail chains, holdings, multi-branch organisations.
- Everything in Kurumsal
- 10 FortiGates
- Restrict users to branch devices
Open questions, straight answers.
What is cloud-based log retention?
Logs are collected and kept in a cloud run by the provider instead of on your own server. With LogHane your FortiGate sends logs over an encrypted connection straight to the cloud; no server, disk or backups to manage.
Are logs kept in the cloud valid for Law 5651?
In the cloud LogHane applies the same rules as on-premises: hourly sealing, timestamps, a delete-proof archive for the retention period and independently verifiable evidence packages. Confirm your own obligation with legal counsel.
Are my logs safe in the cloud?
Devices send logs over TLS with a certificate issued to your organisation; logs without it are not written to your space. Each organisation has separate storage and access, and the sealed archive is object-locked so nobody, not even an admin, can delete it early.
Do I need to install a server?
Not in the cloud. Open an account and paste the syslog commands the panel prepares into your FortiGate. Organisations whose logs must stay on site can install the same software on their own Linux server.
Is the built-in timestamp enough for Law 5651?
LogHane ships a local timestamp server that proves logs were not altered, but it is not a qualified timestamp under Law 5070. Profiles where timestamps are mandatory (access, proxy and hosting providers) must subscribe to a trust service provider and configure it in LogHane.
Which devices are supported?
FortiGate. FortiOS 7.x logs are parsed and the 6.x timestamp format is supported. Other vendors are not supported today.
Would I notice if a log were deleted?
Yes. Segments are chained and the chain is verified regularly. Broken links, shadowing and clock drift raise separate alerts, as does a device that stops sending logs.
Your first sealed log in three steps.
Open an account, connect your FortiGate, watch the first hour get sealed. The panel prepares the syslog commands for you.
FortiGate and FortiOS are trademarks of Fortinet, Inc. LogHane is not affiliated with Fortinet.