What we protect, and what we promise.
Turion handles account credentials, brokerage connections, and the reasoning behind every committee decision. This page describes — in specific, checkable terms — the security measures that exist today, our commitment on AI data use, and an honest roadmap toward SOC 2. We'd rather under-claim and be verifiable than over-claim and be wrong.
Our AI data-use commitment
Turion does not use customer data, portfolios, or queries to train or fine-tune any AI model.
Turion's committee is built on third-party foundation models (Anthropic and OpenAI), which we call through their APIs. Every call is a stateless, per-request call: we send the prompt needed for that one decision and receive a response. We do not fine-tune, train, or otherwise build models on your data, and we do not sell or share your portfolios or queries for advertising or model-training purposes. Requests to these providers are governed by their enterprise API terms, under which API inputs and outputs are not used to train their foundation models.
Security posture today
These are measures implemented in the product right now. Turion is a paper-trading platform — orders are simulated through Alpaca and no real customer funds are moved or held.
Passwords are hashed, never stored in plaintext
Account passwords are hashed with scrypt and a unique per-user random salt, and verified in constant time. Turion cannot read or recover your password — only compare against the hash.
Broker API keys encrypted at rest (AES-256-GCM)
If you connect a brokerage, its API credentials are encrypted with AES-256-GCM authenticated encryption and a per-record initialization vector before they are persisted. They are only decrypted in-memory at the moment a request needs them.
Card data never touches our servers
All payment collection runs through Stripe Checkout and the Stripe Billing Portal. Turion stores only a Stripe customer reference — never card numbers, CVCs, or full payment details.
Tamper-evident sessions, hardened cookies
Sessions use a signed token (HMAC-SHA256) with an absolute expiry. The session cookie is set httpOnly, secure, and sameSite=lax, so it is not readable by JavaScript and is only sent over HTTPS.
Managed Postgres — encrypted in transit and at rest
Application data lives in a managed Postgres database (Netlify DB). Connections are made over TLS, and the managed platform provides encryption at rest by default. All queries are parameterized, which structurally prevents SQL injection.
Hardened HTTP response headers
Responses are served with X-Frame-Options: DENY (clickjacking protection), X-Content-Type-Options: nosniff, and a strict Referrer-Policy. Traffic is served over HTTPS.
What data we collect, and why
We aim to collect only what the product needs to function. We do not buy or sell personal data.
| Category | What | Why |
|---|---|---|
| Account Email address, scrypt-hashed password, optional display name, and role. | Email address, scrypt-hashed password, optional display name, and role. | To create and authenticate your account and apply the correct plan entitlements. |
| Billing A Stripe customer reference and subscription/plan status. No card data. | A Stripe customer reference and subscription/plan status. No card data. | To manage subscriptions and usage-based billing through Stripe. |
| Broker connections Encrypted brokerage API credentials (AES-256-GCM), if you choose to connect one. | Encrypted brokerage API credentials (AES-256-GCM), if you choose to connect one. | To place paper trades on your behalf via Alpaca. Optional — the platform runs without it. |
| Committee decisions & logs Trade decisions, agent reasoning, risk gates, and pipeline run logs. | Trade decisions, agent reasoning, risk gates, and pipeline run logs. | To power the explainable audit trail and your performance history. |
| Usage & metering AI query counts and token usage tied to your account. | AI query counts and token usage tied to your account. | To meter plan limits and bill usage-based access accurately. |
Retention: account and trading-history data is retained for as long as your account is active so your performance record and audit trail stay intact. On account deletion, we remove or anonymize your personal data except where we are required to retain limited records (for example, billing records held by our payment processor). You can request account deletion or a copy of your data by contacting us at the address below.
Compliance roadmap
SOC 2 — In progressTo be direct: Turion has not completed a SOC 2 audit and is not SOC 2 certified. We have not yet begun a formal third-party examination. We are building toward a SOC 2 Type II report, and we'd rather show you the honest state of that journey than imply a status we haven't earned. Here is where each phase stands.
Documented security policies
Writing down the security, access-control, incident-response, and data-handling policies that the practices on this page already reflect in code.
Formalized access controls & monitoring
Least-privilege access to production systems, centralized secret management, and logging/monitoring sufficient to support an audit.
Readiness assessment (gap analysis)
Engage a SOC 2 tooling/advisory partner to run a gap analysis against the Trust Services Criteria and remediate findings before an audit begins.
SOC 2 Type II examination
A future independent third-party audit covering a defined observation window. Turion has not yet undergone this audit and does not claim SOC 2 certification today.
Security & trust contact
Report a vulnerability, request our current security documentation, or ask a data-handling question. We aim to acknowledge security reports promptly and will not pursue researchers who act in good faith.
security@turion.exampleFor compliance and disclosure information, see our full disclosures.