Not because reviewers are difficult — because most AI vendors can't answer them. This page exists to make your review short: what isolates tenants, what gates actions, what gets recorded, and how each control maps to the framework you assess against. Send the hard questions to hello@turtleaicoworker.com — answering security questionnaires is part of the job, not a favor.
Every object — table, agent, credential, policy, audit row — carries its organization and workspace scope, and every query is filtered server-side. Isolation is a data-layer property, not a UI convention.
Google and Microsoft SSO, TOTP two-factor with backup codes, a hard cap of 4 concurrent sessions per user, and rotating JWTs with blacklist-after-rotation.
The policy engine and a runtime authorization floor evaluate every tool call before it executes. Unapproved writes are a no-op — whatever the prompt said.
Every run and tool call recorded with sanitized data, PII flags and read/write classification — pinned to the immutable config version it executed under.
The account-security layer your review checks first — federated identity, second factors, bounded sessions and a single source of truth for authorization.
Single sign-on via Google and Microsoft OAuth2, so access follows your identity provider and offboarding follows your directory.
Time-based one-time-password two-factor with recovery backup codes, enforced per account.
A hard cap of four concurrent sessions per user. A fifth login displaces the oldest — sessions are enumerable and revocable.
Short-lived access tokens over rotating refresh tokens; every rotation blacklists the predecessor, so a stolen refresh token dies on first reuse.
Owner, Admin, Builder, Member — one role per person, and a single role × action authorization matrix answers every permission check identically across web, mobile and API.
Role changes, policy edits and security-relevant actions land in the audit trail like everything else — reviewable, filterable, exportable.
A policy PDF asks the AI to behave. Here, the policy engine evaluates every tool call before it executes — 6 rule types, 5 verdicts — and a runtime authorization floor makes unapproved writes a no-op, even if a prompt injection put them in the plan. Approvals are single-use and expire in 24 hours. The full mechanics live on the Governance and Approvals pages; the point for your review is placement: in the execution path, covering chat, schedules, triggers, API and MCP identically.
Custom-tool credentials are encrypted at rest and decrypted only at the moment of the call; the API returns them masked, never in the clear. OAuth tokens for integrations stay server-side and are never exposed to a model.
A per-workspace PII policy detects emails, phone numbers, SSNs, card numbers, addresses and names in what agents read and write, with four redaction modes and allowlist patterns for the exceptions.
A prompt-injection shield screens untrusted content — tool results, knowledge chunks, table rows, webhook payloads — before it re-enters a model's context, and flags, wraps or blocks suspected instructions.
API keys, tokens, passwords and card numbers are redacted before any audit record is stored. The trail is complete without becoming a secrets store.
Every trigger firing is logged — including filtered, debounced, rate-limited and failed firings — idempotent by provider event ID, so replayed webhooks can't double-execute.
Hard daily and monthly budget caps with breach-date forecasting, and circuit breakers that auto-pause a worker when a cost or error threshold trips.
When your auditor asks what an agent did on a given Tuesday — and what it was allowed to do that day — both answers are queries, not archaeology.
Per-run records with per-tool-call detail: integration, function, read-vs-write classification, sanitized inputs and outputs, PII flags, token and dollar cost. Filterable by workspace, worker, integration, user and date.
Configuration changes create versions; runs pin the version they executed under. "What was this agent allowed to do in March" has one exact, tamper-evident answer.
Per-workspace retention policies govern audit and compliance data, and a legal hold freezes any purging while exports stay available — for litigation, investigation or a regulator's clock.
Your reviewers don't assess "features" — they assess against a framework. Below, the concerns each framework raises about AI systems, and the platform controls that produce evidence for them. This is a control mapping, not a certification claim — we're telling you what to inspect, not what to take on faith.
We do not claim certification against any of these frameworks on this page. Running an assessment? Send your security questionnaire to hello@turtleaicoworker.com and we'll complete it.
Workspace content (tables, knowledge, chats, traces) is never used to train models, ours or anyone else's.
Bring your own provider keys and prompts go to the model provider you chose, under your agreement with them, not through terms we negotiated for you.
Delete your workspace and its data is deleted: tables, knowledge, run history and stored credentials with it.
Only the providers an agent is configured to use ever see a prompt. No silent additions: this list changes only when the product does.
We would rather tell you "in progress" than show you a badge we haven't earned. Here's the honest state of things.
Certification is underway with an independent auditor. We'll publish the report here when it's complete, not before.
A DPA is available on request for customers who need one, including standard contractual clauses where applicable.
SSO, audit exports, data residency options and self-hosted deployment are available on the Enterprise plan today.
The completed security questionnaire is published — no call required. For architecture walk-throughs, data-flow diagrams or your own questionnaire format, ask.
