Security facts

What Turncrest does today, and what it does not. This page lists implemented controls only.

Tenant isolation: PostgreSQL row level security on every tenant table. Composite foreign keys stop records from referencing another organization or project. Automated tests check cross-tenant and same-tenant project isolation.
Role-based authority: Only project managers approve requirement definitions, review evidence, record waivers and record GC acceptance. The database enforces these rules as well as the application.
File handling: Uploads go to a private quarantine, are identified from their bytes (the browser's declared type is ignored), hashed with SHA-256 and malware scanned before anyone can open them. Unscanned files cannot be previewed, exported or sent to AI.
No public file links: Every file and package download passes through an authorization check on each request.
Shared links: Supplier upload links and package review links use 256-bit random tokens stored only as hashes. They expire, can be revoked and are rate limited. They never grant an account.
Immutable records: Document versions and generated packages cannot be altered. Review events and audit events are append-only.
Two-factor authentication: Organization admins must verify with an authenticator app before managing team, billing or exports.
Data export: Admins can export every record as JSON plus every original file with hashes. Cancelling a plan never deletes records.
AI boundaries: AI is optional and off unless configured. Document text is treated as data, not instructions. AI output is a proposal with a cited page; it cannot change records, send messages or reach other projects.

Not claimed

No SOC 2, ISO 27001 or other certification. None is claimed.
No contractual uptime commitment.
Single sign-on (SAML) and SCIM provisioning are not available yet.
Files a recipient already downloaded cannot be recalled by revoking a link.
Rate limits for shared links are per server instance in this release.

AI provider data retention depends on the provider agreement in place for your deployment. Ask us for the current terms before enabling AI.