Kastamonu Smart City and Digital Institutional Archive: A Security-Focused Public Architecture
Score —Design principles of the digital institutional archive and smart city open data platform I developed for Kastamonu Municipality: zero trust, four-eyes approval, immutable records and open data.
Contents
Summary: I explain the design principles of the digital institutional archive and smart city platform I designed for the Kastamonu Municipality Information Technology Directorate: zero trust, four-eyes approval, post-quantum-ready seals, confidentiality levels, an immutable record chain, and an open data layer that publishes field teams' data.
Municipal archives carry a city's institutional memory: zoning plans, council decisions, tender files and citizens' personal data. Deleting, altering or ransomware-locking these records can bring the institution's operations to a halt. Local governments are now regular targets of such attacks.
For this reason, I designed and developed a "Digital Institutional Archive and Smart City" platform for the T.C. Kastamonu Municipality Information Technology Directorate. In this article I explain the platform's core design principles. For security reasons, I do not include details about the system's operating environment.
Design principles
I built the system on a zero trust approach: no user or component is considered trusted just because it is inside the network.
-
Four-eyes approval. Operations such as deleting critical documents or changing their confidentiality level cannot be carried out with a single person's approval. The person who initiates the operation and the person who approves it are separate. This is a simple but effective safeguard against both errors and misuse of authority.
-
Post-quantum readiness. The digital seals on documents use quantum-resistant signature algorithms standardized by NIST alongside classical signatures. The aim is for records sealed today to remain verifiable in the long term.
-
Confidentiality levels. Documents are classified according to their confidentiality levels, and staff can only see records at their own authorization level. This restriction is enforced in the data layer, not in the interface.
Immutable record
Records added to the archive cannot later be deleted or altered. Each record is linked to the previous one with a cryptographic digest, so any direct tampering with the records is detected during verification.
Open data layer
The platform also has a side open to citizens and developers:
- Information from field teams such as Public Works, water and sewerage, and transportation—closed roads, excavations and outages—is published in GeoJSON format.
- Past outage records are analyzed to predict in which areas maintenance needs may increase.
- The structure was designed to be compatible with the open data goals of the National Smart Cities Strategy and Action Plan.
Development principles
- The interface and error messages were written in plain, formal language.
- Servers using error-correcting (ECC) memory were recommended for cryptographic operations.
The platform's source code was published in Kastamonu Municipality's GitHub organization:
Kastamonu Municipality GitHub Repository - kastamonu-akilli-sehir-platformu
My aim was to treat the municipality's data not as a pile of paperwork but as a public asset that must be securely protected and transparently shared.
My reading
- Institutional memory should not rest with one person: four-eyes approval on critical deletions and confidentiality changes protects against both error and misuse.
- Records cannot be altered after the fact: linking each record to the previous one with a cryptographic digest makes direct tampering visible during verification.
- Protection and transparency together: while sensitive documents are strictly protected, information such as closed roads, excavations and outages is offered to citizens and developers as open data.