€100 store credit for firms that start before 31 December 2026, and a 60-day full refund. Terms apply Get early access

Security annex

Turstone Limited, Ireland. Company number: 829240. Registered office: Biorrabeag, Lackan, Multyfarnham, Mullingar, Co. Westmeath, N91 Y738.

Checked by Turstone against its own code and infrastructure; not reviewed by a solicitor.

Version 1.0, 2026-10-28, owner: Turstone Limited (Ireland, CRO 829240). This annex is part of the Turstone data processing agreements.

The measures are in two lists: those in place in the product and its infrastructure code, and those Turstone commits to complete before any real customer data is processed.

In place

Tenant isolation, in three layers

  1. Every practice's rows carry a tenant id and PostgreSQL row-level security (RLS) is forced on every tenant table; the application role cannot bypass it.
  2. Composite foreign keys keep related rows inside one tenant.
  3. Every request and job runs inside a tenant-scoped transaction; there is a cross-tenant test for every route.

The application process is trusted to set the tenant. That is a known limit of pooled RLS, and it is why the code paths that set it are small, mutation-tested and reviewed.

Encryption

  • At rest: the database, backups, logs and storage use customer-managed keys in AWS KMS. Stored connector credentials are sealed with per-practice data keys wrapped by KMS; sign-in refresh tokens are sealed with a platform data key wrapped by KMS.
  • In transit: TLS 1.2 or higher to the app; the application connects to the database with verify-full TLS against the pinned RDS certificate authority; production refuses to start otherwise.
  • Links in text messages carry a random token of at least 128 bits, stored hashed, single-purpose, expiring, and containing no personal data.

Identity and access

  • Sign-in through Auth0 (EU tenant). Multi-factor authentication is required for owners and agency users; staff roles are limited by permission in our database.
  • Agency access is a time-limited grant approved by the owner with a pairing code, revocable at any time.
  • Sessions: 30 minutes idle, 12 hours absolute; refresh tokens rotate and are sealed.
  • Least privilege: separate database roles for the application, the worker, migrations and the ops console; separate cloud task roles per service.

Turstone operator access

The ops console reads metadata only through column-level grants. Reading anything more needs a break-glass session (1 to 60 minutes, a reason from a fixed list, a ticket reference). Every console action is written to an append-only access log, and break-glass writes a row in the practice's own audit log.

Data minimisation and logging

  • Only the administrative fields in the DPA are stored; calendar titles and descriptions never are.
  • No personal data, secrets or message bodies in application logs; errors are serialised with a safe serialiser. The edge keeps no path or query in its logs and none at all on the link host.
  • Text-message bodies are scrubbed after 90 days; see Turstone's data protection impact assessment.

Front-office modules

  • Free text a patient sends to the practice's number is sealed (encrypted with the practice's data key, bound to the practice and the message) before it is stored, is never shown whole in a list or a log, and its ciphertext is deleted after 90 days.
  • The public booking-request page and the website contact form use single-use signed tickets and rate limits; the booking page also proves the mobile with a code by text, limited per number, per address and per day.
  • Patient payments use Stripe Checkout on the practice's own Stripe account: card data never reaches Turstone (the scope is SAQ-A), Turstone holds no funds and keeps no saved cards. A Stripe secret exists only in the ops service family; the web service never holds one.
  • WhatsApp (optional): messages go through WhatsApp Ireland Limited, which transfers them to WhatsApp LLC and Meta Platforms, Inc. in the United States (see Turstone's transfer impact assessments); the access token, the app secret and the verify token are separate secrets, each held only by the service that needs it.

Messaging controls

Fixed templates with a closed set of variables, no patient free text echoed, an opt-out link in every message that suppresses all future messages to that number for that practice, quiet hours, a cap on recalls per person, and exactly-once sending keys.

Availability and recovery

Multi-AZ database; the database's own automated backup window is 14 days, and a vaulted copy in a second EU region (eu-central-1) is kept 35 days, so backups are overwritten within 35 days of creation. Monitoring and alarms on the sending, sync, retention and billing paths.

Vulnerability management and secure development

Dependency and secret scanning, static analysis (Semgrep with custom rules), container scanning, a ZAP baseline scan in CI, strict TypeScript and lint rules, mutation testing on the security core, and CI gates on every change. Third-party images and dependencies are pinned and at least 7 days old.

Incident response

See the breach-response runbook; the DPA commits Turstone to notify the practice within 24 hours of awareness.

Committed before any real customer data

  • A restore drill: restoring the database from backup and recording the result.
  • A ZAP full scan (CI runs only the baseline today).
  • An agent adversarial security review of the hosted app (cross-tenant access, authentication, links, webhooks, uploads), with its findings fixed.

Until these are done, Turstone processes no real customer data.

Penetration testing

No external penetration test before launch; the agent security review and the ZAP full scan stand in for it. A paid external test may follow once revenue allows.