How Turtini protects your data

Turtini is built on security-first infrastructure. Here is a plain-language summary of the protections in place.

Encryption:
• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• This applies to every record, file, and message stored on the platform

Org data isolation:
• Each organization's data is strictly separated at the database layer
• No application bug or configuration change can expose one org's data to another
• Members only see data belonging to their own org (or data explicitly shared with them)

Access control:
• Every org has Owner, Admin, and Member roles with clearly defined permissions
• Sensitive actions (billing, member management, module changes) require Admin or Owner access

Payment security:
• Turtini does not store credit card numbers, CVVs, or raw payment credentials
• All payment processing is handled by Stripe, which is independently audited and certified
• Only the last 4 digits and card brand are stored for display purposes

Content safety:
• Uploaded images and files are automatically reviewed by a safety pipeline before display
• Flagged content is held for human review — it is never shown until cleared

Security monitoring:
• Turtini operates a continuous security monitoring system across platform activity
• Security events are logged and reviewed by the platform team

For a full overview of our security posture, certifications, and data governance practices, visit turtini.com/security