Security

Infrastructure

TurnCap runs on Amazon Web Services. The application runs on EC2; the database is Amazon RDS for MySQL, deployed in a private subnetwith no public access, with storage encryption enabled. Project documents (budgets, invoices, approvals) are stored in Amazon S3 and accessed through the server's instance role — no long-lived credentials in application configuration.

All traffic is served over TLS using Caddy with automatic Let's Encrypt certificates on every host.

Data protection

Integration credentials (OAuth tokens) are encrypted at rest withAES-GCM, and the application fails fast rather than starting in production without its encryption key configured. The database itself hasautomated daily backups with 7-day retention.

Access control

• Org-scoped isolation. Your data is partitioned by organization — one customer's properties, projects, and financials are never visible to another.
• Login rate limiting. Repeated failed login attempts are throttled to slow credential-guessing attacks.
• Share-link rate limiting. Public owner-report links are rate-limited too, so a leaked URL can't be hammered at scale.
• Approval gates. Spend above your organization's configured threshold routes through approval before it counts — a check, not an honor system.
• Guarded deletes. Deleting records with money attached is deliberately constrained, so financial history can't vanish by accident.

Monitoring & audit

Every money flow — commitments, actuals, change orders, approvals — is written to an audit trail recording what changed, when, and by whom. When a number moves, there's a record of it.

Honest limits

We describe what TurnCap actually does today — no certification badges, no audit reports we don't have. If you need details on anything above, ask us at hello@turncap.io.