Questions about Turret
Straight answers about what Turret covers, what it costs, how setup works and how your data is handled, including what Turret does not do. Can’t find yours? Email support@getturret.com.
Product and scope
What is Turret?
Turret is compliance recordkeeping and supervision software for small SEC-registered investment advisers (roughly 2–20 people): it archives Google Workspace or Microsoft 365 email and the firm's website under Advisers Act Rule 204-2, flags risky outbound email with AI triage, and runs a Marketing Rule review-and-approval workflow.
Which product do I need?
Email if your obligation is keeping and supervising your firm's email. Marketing if you need advertising reviewed, approved and kept on file under the Marketing Rule; it needs no email connection. Complete if you need both; it costs less than buying the two separately. Website archiving comes with all three.
Does Turret surveil inbound email or attachments?
No to both. Inbound mail is archived as a record, and patterns and alerts run on outbound mail only, on Google Workspace and Microsoft 365 alike. Attachments are archived with their name, type and size, but the text inside them is not scanned.
Does Turret capture texts, WhatsApp, LinkedIn or other social media?
No. Turret covers email and your firm's website. If your advisers do business over text or messaging apps, you need a vendor that captures those channels, or a policy that keeps business communication on email.
Does Turret meet SEC Rule 204-2 for email?
Turret keeps every active mailbox's sent and received mail, including mail that was filed away or deleted, for 7 years, while you subscribe. It adds full-text search and a SHA-256 hash per message, so you can show the records haven't changed. Whether your recordkeeping as a whole satisfies Rule 204-2 depends on your policies and practices, which is a judgement for your CCO and counsel. Turret provides the records and the evidence.
What do I hand an examiner?
The Supervision Activity Report, which shows what was checked, flagged and reviewed and by whom. The Archive Integrity Verification Report, which shows every archived message re-hashed against its SHA-256 baseline; the latest one is downloadable from Reports. And the records themselves: searchable email, dated website versions and approved marketing pieces. Turret supports your supervision programme; it does not replace your CCO or counsel.
How do you keep false positives down?
Legal footers, disclaimers, signatures and quoted replies are stripped before the patterns run, and the original stays in the archive. A reply that only inherits a flagged subject line doesn't raise a new alert. When reviewers keep dismissing the same thing, Turret proposes a suppression that does nothing until an Admin approves it. Auto-clear of low-scoring alerts is off unless you turn it on, and at least 10% of those alerts are always held back for a person to review.
Why not just use Google Vault or Microsoft 365's own tools?
Google Vault and Microsoft 365 retention keep your mail and support eDiscovery. Microsoft sells supervision as Purview Communication Compliance, which needs Purview Suite / E5-level compliance licensing for each monitored user. Turret's difference is packaging and price: compliance patterns written for advisers, AI triage with a written reason, website archiving, a Marketing Rule workflow, and supervision and integrity reports, in one product at a published price that works the same on Google or Microsoft.
We're XYPN members. Do we need Turret?
Possibly not. If your membership already includes an archive, check what it retains and reviews before you buy; Turret won't be cheaper than something you already pay for. What Turret offers beyond retention: outbound surveillance with AI triage and a reviewer queue, the Supervision Activity Report, and a Marketing Rule review workflow. Check whether your current tools already cover any of these.
Is website archiving included in my plan?
Yes. It is included with Email and with Marketing, and Complete has both. There is no separate price for it. You can turn it on from Settings.
Can Turret archive a site that isn't on our domain?
Yes, after review. Your firm's own domain is accepted as soon as you confirm it. Any other address becomes a request that our team approves or declines, and you get an email with the decision; if we decline, the email gives the reason.
Pricing and billing
How much does Turret cost?
Email is $99 a month and includes 5 mailboxes, then $25 per additional mailbox. Marketing is $99 a month and includes 5 submitters, then $15 each. Complete is both for $178 a month, with extra submitters at $10. Annual billing is $990, $990 or $1,780 a year, and prices exclude tax.
Is there a setup fee or a contract?
No setup fee. You choose monthly or annual billing and can cancel anytime from Settings; access continues to the end of the period you have paid for.
What counts as a mailbox?
Every active mailbox in your Google Workspace or Microsoft 365 domain, whether or not it sends mail, because Turret archives it either way. Suspended accounts don't count. Email and Complete include 5, and each additional one is $25 a month. Coverage is never capped to hold a price.
Is my card charged during the trial?
No. A card is required at the end of setup, and the first charge is on day 15. Cancel before then and you pay nothing.
How does the Complete saving work?
Email and Marketing are $99/month each. Have both and $20/month comes off ($200/year on annual), automatically. Complete is therefore $178/month whether you buy both today or add the second product later. The saving is on the two base prices: additional mailboxes are not discounted, and additional submitters are $10/month instead of $15.
Can I add the other product later?
Yes, both ways, from Settings → Billing. Add Marketing to Email and it is $99/month; add Email to Marketing and you connect your mail in the same setup steps, with no second checkout. Either way the bundle saving applies from your next bill, so you pay the same $178 as buying Complete on day one.
Can I cancel, and what happens to my records?
Yes, from Settings at any time. Access continues to the end of the period you have paid for; your archive is then kept for 60 days, during which you can request a full export by emailing us, and after that it is deleted. An annual plan runs to the end of the paid year, and the prepaid year isn't refunded. Removing Marketing takes effect at the end of your billing period, and removing an extra submitter at your next renewal, with no refund for time already paid. If a payment fails, access continues for a short grace period while you update your card. After that, access pauses and nothing is deleted at that point. If the balance stays unpaid for 90 days from the first missed payment, your records may be deleted, so request an export before then. Your firm remains responsible for retaining its records under SEC Rule 204-2.
More: Who counts as a submitter
See plansSetup
How long does setup take, and how long until my archive is built?
Authorizing takes about ten minutes. During the free trial Turret archives your most recent 90 days of mail and checks the last 30 days of outbound mail. It reads each mailbox at a paced rate so your own mail keeps working, so this takes hours rather than minutes, and longer for a very busy mailbox. Your full retention window (7 years) and a year of outbound checks start after your first payment, and can take several days for large mailboxes. Marketing needs no archive and is ready as soon as setup finishes.
Does Turret read my mail before I pay?
Once, to check the connection. On the verify step Turret lists your users and reads one message to confirm the authorization works. Nothing is archived and no mailbox is walked until you enter a card at the end of setup.
Who has to do the setup, and is there anything to install?
Nothing is installed: no agents, no browser extensions, no employee downloads. For Google Workspace, a super admin authorizes Turret's service account in the Admin Console. For Microsoft 365, a Microsoft 365 administrator who can grant tenant-wide admin consent approves Turret's app. Marketing needs no administrator and no connection.
Is there any difference between Google Workspace and Microsoft 365?
Both capture sent and received mail, including filed and deleted mail, and both are read-only. On Microsoft 365, Turret does not reach the separate online-archive mailbox or mail that has been permanently deleted (Recoverable Items), and the Microsoft consent screen may label the app as unverified. Signing in to Turret is with Google or an email and password; "Continue with Microsoft" is not available.
Can our outside CCO or consultant get access?
Yes. Invite them as a Viewer: they see alerts, the archive and reports, change nothing, and never touch your Google Workspace or Microsoft 365. Viewers do not receive escalation emails or the weekly digest.
Security and compliance
Do you hold SOC 2?
Not yet. A SOC 2 Type 1 readiness assessment and CASA Tier 2 are planned; neither is held. What is in place now is on our Security page: read-only access your admin can revoke, AES-256-GCM for stored credentials, TLS in transit, tenant isolation and a SHA-256 integrity log.
Who at Turret can see our email?
Turret staff do not access email content as part of normal operations. Our administrators can technically open a firm's archive, for example to build an export you ask for, so we don't claim that no one ever can.
Is our data sent to an AI model?
Yes. For each email alert, Turret sends the subject, the sender and recipient addresses, the matched text and snippets your reviewers previously dismissed for the same pattern to Anthropic's Claude for a score and a written reason; Social Security and card numbers are redacted first. For the Marketing pre-screen, the submitted piece, its title and the submitter's notes are sent to Claude unredacted. The AI never approves marketing, and it closes an email alert only if you have turned on auto-clear.
Where is our data stored?
Turret's application and database are hosted in the United States (Oregon); subprocessors are listed in our Privacy Policy, including Anthropic, which provides the AI triage. Stored credentials are encrypted with AES-256-GCM, all data is encrypted at rest by the database platform, and all traffic uses TLS.
Is the archive tamper-proof?
It is tamper-evident, not physically immutable. Every archived message carries a SHA-256 hash in an append-only log, and a verification run re-hashes the archive and reports any record that no longer matches. The latest Archive Integrity Verification Report is downloadable from Reports.
Do you sign a DPA?
Yes. A data processing addendum is available on request from support@getturret.com.
Marketing Rule
Does the AI approve marketing?
No. The AI pre-screen reads a submitted piece and drafts findings against Rule 206(4)-1, each showing the language that triggered it. It cannot approve, reject or block anything. A named reviewer makes every decision, and approval is bound to the version they approved.
Can I buy Marketing without Email?
Yes. Marketing is sold on its own and needs no email connection. Your team submits pieces for review in Turret, and website archiving is included. You can add Email later from Settings, and the bundle saving applies automatically.
How does the advertising retention clock work?
Rule 204-2(e)(3)(i) keeps an advertisement's records for five years from the end of the fiscal year in which it was last published or disseminated. Turret records where and when each approved piece is used and works out that date per piece. While a piece is still in use, it shows no date.
What does the AI see?
For the Marketing pre-screen, the submitted piece, its title and the submitter's notes are sent to Anthropic's Claude unredacted. The AI never approves marketing. If you also use Turret Email, the Security page sets out exactly what alert triage sends.
Still deciding?
Try the live demo with demo data, or start a 15-day free trial on your own firm.