Security Practices

Last updated: October 7, 2026

Turnstone handles sensitive financial documents: CIMs, teasers, and proprietary deal data. This page describes, accurately and without marketing gloss, how we protect that data.

Data Encryption

All traffic between your browser or the iOS app and Turnstone is encrypted with HTTPS/TLS, and our API sends HTTP Strict Transport Security (HSTS) headers to prevent downgrade attacks.

Stored data, including the database, uploaded files, and backups, is encrypted at rest with AES-256 by our infrastructure provider, Supabase, which runs on AWS. Uploaded files are kept in private storage and can only be downloaded through short-lived, signed links issued to the file's owner.

Tenant Isolation

Every request made on your behalf runs as a restricted database role with no ability to bypass security policies, and with your account ID set for that transaction. PostgreSQL row-level security (RLS) policies then allow that role to read and write only rows that belong to you, and to update only the account fields you are allowed to change.

Policies apply to every table that holds customer data. Data is isolated even if a query omits its own user filter.
A small set of system operations run with elevated database privileges and are scoped in application code: looking up your account at sign-in, processing payment webhooks, and serving public share links you choose to create.
Isolation is checked by automated tests that run the real query path against a real PostgreSQL database.

Authentication

Sign-in is handled by Auth0 (Okta). Turnstone never sees or stores your password.

OpenID Connect sign-in, including Google sign-in through our own Google OAuth credentials
Every API request is verified with an RS256-signed JSON Web Token issued by Auth0
API keys (for the API and the Claude connector) are stored only as bcrypt hashes and can be revoked at any time in Settings. Keys issued to the Claude connector expire after 90 days.
Account deletion and terms acceptance require an interactive sign-in and cannot be performed with an API key

File Security

Uploaded files are validated before processing:

Content checks. PDFs are verified by their binary signature, and file extensions are matched against the actual file type.
Filename sanitization. Path-traversal characters and unsafe sequences are stripped.
Decompression-bomb protection. Spreadsheets are size-checked before they are parsed.
Upload limits. 25MB per file and up to 10 files per upload. Document-room uploads are capped at 50MB in total.

AI Processing

Turnstone uses the Anthropic Claude API to analyze documents. All AI calls happen on our servers, so your browser never talks to the AI provider and no AI keys are exposed in the app.

No model training. Under Anthropic's commercial terms, data sent through its API is not used to train its models.
Limited retention. Anthropic deletes API inputs and outputs within 30 days, or keeps them for up to 2 years if its automated systems flag them for a usage-policy violation.
Industry research. To research a deal's industry, searches built from the target company's name, industry, and location are run through Anthropic's web search tool.
Access. Turnstone staff do not read your documents in the normal course of running the Service. We access account data only to provide support you ask for, to investigate errors or abuse, or when required by law.

Network Security

CORS allowlist. Cross-origin requests are accepted only from an explicit list (our web app, the iOS app, and our local development address), never from any origin.
Rate limiting. API endpoints enforce request rate limits.
Security headers. HSTS, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), and a strict Referrer-Policy are sent on API responses.
Content Security Policy. The web app restricts which scripts, styles, and connections it can load, to limit cross-site scripting.

Monitoring, Logging & Error Handling

We use Sentry for error monitoring. Error reports have authorization headers and cookies removed before they are sent. When an error happens in the web app, Sentry may capture a short recording of the screen around it, with all text and form inputs masked and images blocked.

Server logs record request paths with share-link tokens and sign-in codes removed. API error responses in production contain only generic messages, never stack traces or internal details.

Compliance & Policies

To ask a security question or report a vulnerability, contact support@turnstone.app.