---
title: "Security"
description: "How TurboPentest isolates tool execution in per-pentest containers, protects and encrypts your data, and maintains compliance across the platform."
canonical: https://turbopentest.com/docs/architecture/security
source: "TurboPentest Docs"
---

# Security

Security is foundational to TurboPentest. This page details how we protect your data, isolate tool execution, and maintain compliance.

## Container Isolation

Every security tool runs in its own Azure Container Instance:

- **No shared state** - Each container is a fresh instance with no access to other containers
- **Dedicated resources** - CPU and memory are allocated per tool, not shared
- **Network isolation** - Containers can only communicate outbound to the target and inbound via callback webhook
- **Ephemeral** - Containers are destroyed immediately after the tool completes

## Code Handling

For white box pentests that connect to GitHub:

- Source code is cloned into an ephemeral container at runtime
- Code is **never stored** on persistent storage
- The container (and all code within it) is destroyed after the tool completes
- GitHub access tokens are scoped to the minimum required permissions

## Data at Rest

- Pentest results are stored in Azure Blob Storage with encryption at rest
- Database records are stored in Neon (serverless PostgreSQL) with encryption at rest
- PDF reports and attestation letters are stored in encrypted Blob Storage
- Users can delete their pentest data at any time

## Data in Transit

- All traffic is encrypted with TLS 1.2+ in transit; Anthropic API calls use TLS 1.3
- Azure App Service enforces HTTPS
- Tool callback webhooks use HTTPS
- API authentication uses `Bearer tp_...` keys transmitted via the `Authorization` header

## Secrets Management

- Application secrets are stored as Azure App Service environment variables
- No secrets are hardcoded in source code
- GitHub tokens are encrypted in the database
- API keys are stored as SHA-256 hashes and shown only once at creation

## CI/CD Security

Every push and pull request runs automated checks, and merges to the main branch run a full build before deploying:

1. **ESLint** - Static analysis for code quality and security patterns, on every push and pull request
2. **Content review** - Automated documentation/content checks, on every push and pull request
3. **Vitest** - The test suite runs on every push and pull request
4. **Production build** - On merges to main, a full Next.js build runs (which also enforces TypeScript type checking and catches runtime errors) before deployment
5. **Automated deployment** - Only builds that pass reach production on Azure App Service

## Compliance

TurboPentest maps findings and testing coverage to four compliance frameworks, each with a default evidence max-age of 365 days:

| Framework | Details |
|-----------|---------|
| SOC 2 | Security practices aligned with the SOC 2 Trust Service Criteria |
| ISO 27001 | Controls mapped to the ISO/IEC 27001 information security standard |
| PCI DSS | Payment Card Industry Data Security Standard coverage |
| HIPAA | Safeguards for protected health information |

The compliance dashboard tracks per-framework scope, staleness (fresh / stale / never_tested), last scan, next scheduled scan, and control mappings. For complete compliance documentation, visit our [Trust Center](https://trust.integsec.com).

## Responsible Disclosure

If you discover a security vulnerability in TurboPentest, please report it to security@integsec.com. We take all reports seriously and review them promptly.