Security

Turbine uses authenticated sessions and provider authorization flows. Internal access to production systems should be limited to people who need it to operate, debug, secure, or support the service.

Connected providers can be revoked from the app or from the provider account. Users should disconnect sources they no longer want Turbine to access.

OAuth tokens, integration secrets, and production configuration should be stored with encryption or managed secret storage, separated from source code, and never committed to the repository.

Provider credentials are used to provide connected features and should not be shared with third parties except subprocessors needed to operate Turbine.

Turbine aims to collect the minimum permissions and source data needed for scheduling, context, and user-facing assistant features. Integrations should be opt-in, and users should be able to disconnect sources they no longer want Turbine to use.

Approval flows and audit-style action records help make material changes visible and reversible where possible.

Security issues can be reported to security@turbine.so. Please include enough detail to reproduce or assess the issue and avoid accessing, modifying, or disclosing data that does not belong to you.