Security

Access model

Turret connects through your existing email provider with read-only access that your administrator authorizes and can revoke at any time. It cannot send, modify, delete, or forward any email.

• Google Workspace: Domain-Wide Delegation with a service account your Super Admin authorizes, holding read-only scopes gmail.readonly and admin.directory.user.readonly. Revoke any time from your Google Admin Console.
• Microsoft 365: an admin-consented Microsoft Graph application holding read-only permissions Mail.Read and User.Read.All. Revoke any time from your Microsoft 365 admin center.

Encryption

Credentials (service account keys and OAuth tokens) are encrypted with AES-256-GCM at the application layer before being written to the database, using a key held separately from the data. All customer data is encrypted at rest by the database platform, and all traffic is encrypted in transit via TLS 1.2+.

Tenant isolation

Every database record is scoped to a tenant ID. Application-layer queries always filter by tenantId. One firm's data is never accessible to another firm, even on the same infrastructure.

PII handling

Pattern-matched snippets are redacted before being written to the database. Social security numbers and credit card numbers detected in email content are replaced with masked values before storage. Raw email content is compressed and stored for archive purposes but is never logged or exposed in error messages.

Staff access

Turret staff can access operational metadata (job status, error logs, scan counts) for support purposes. Turret staff do not access email content as part of normal operations. Alert actions and archive writes are recorded in append-only audit tables with SHA-256 content hashes.

Compliance posture

• — SOC 2 Type 1 readiness assessment planned
• — CASA Tier 2 security review planned prior to marketplace listing
• — Data processing addendum available upon request