Security at Turrety

Local decisions by design

The engine runs inside your process, so your traffic never passes through us. If Turrety goes down, your apps keep enforcing the last good rule set. Rule sets and virtual patches are signed, and agents reject anything that does not verify.

Data protection

• TLS 1.2+ in transit, AES-256 at rest.
• Nothing sensitive leaves the agent: events carry the method, path, address and the rule that decided, never bodies, query values or cookies.
• API keys are stored as hashes and can be scoped per environment.
• Every organization is isolated at the database level.

Access control

Staff access to production requires SSO, hardware keys and a logged reason. Customer data is accessed only to answer a support request you opened.

Vulnerability disclosure

Found a security issue in Turrety or its agent? Email [email protected] with the steps to reproduce it. We acknowledge within 2 business days, keep you updated and credit you once it is fixed. Please do not access other customers’ data or degrade the service while researching.

Requests that slip past a rule count too: send the request and the rule id shown in your dashboard, and we will ship a fix to every customer.

System status

Incidents and maintenance windows are announced by email to organization owners. If the control plane is unreachable, agents keep enforcing the last rule set they verified, so your apps stay protected.