Skip to main content

​
Architecture

Turen runs entirely on your infrastructure. Each developer’s machine (macOS, Linux, or Windows) gets a lightweight agent, and your organization’s data stays under your control.
Turen dashboard with a live claude-code terminal flagging a typosquat of chalk, beside a Claude Code Activity panel showing 247 packages scanned, 12 blocked, and 3 SAST findings.

The Turen dashboard shows Claude Code's live terminal on the left and flagged activity on the right: packages scanned, blocked installs, and SAST findings.

​
Security Hooks

Turen enforces its rules through Claude Code hooks, not by intercepting network traffic. Claude Code connects directly to the Anthropic API; Turen’s hooks run locally as Claude Code works:
  1. Command validation: before a shell command runs, turen-pkg checks it against your rules and blocks dangerous operations.
  2. Package security: before a package is installed, turen-pkg evaluates it against your scorecard, vulnerability, and license policies.
  3. Code scanning: as code is written, turen-batou scans each change for vulnerabilities and can block insecure code.
  4. Prompt and output inspection: prompts, command output, and fetched web content are checked for prompt injection and secret exposure.
Because these run as hooks, a blocked action is stopped before it executes: no traffic is rerouted, and nothing is added to the LLM request path.
These hooks are fully supported on Claude Code. Codex runs the same rules through its own hook interface in preview. Some Codex shell and non-shell tool paths are not hookable yet, so on Codex these checks are best treated as an additional layer rather than a complete boundary. Command, injection, and secret detections are reported to the dashboard for both agents, and session collection and usage telemetry are derived for both.
Developers continue using Claude Code exactly as before. The installer configures Claude Code automatically via managed-settings.json, registering the hooks. No manual setup required.

​
The Daemon

The Turen daemon is a background service that handles everything else:
  • Registration: one-time setup that links the machine to your organization. Developers register by signing into the Turen desktop app, which enrolls the machine over local IPC (no key needed). Headless and fleet installs can register with a registration key instead.
  • Policy sync: periodically fetches the latest rules from your Turen dashboard.
  • Check-ins: sends heartbeats so the dashboard knows which agents are online.
  • Session collection: reads Claude Code’s local session transcripts and uploads them encrypted.
  • Usage telemetry: reconstructs token, model, and cost data from those transcripts for the LLM analytics dashboard.

​
Security Rules

Turen ships with 96 built-in rules across three categories: Rules are evaluated in real time as Claude Code works: blocked actions are stopped before they run. You can also create custom rules for your organization’s specific needs.

​
Session Recording

Every Claude Code session is automatically recorded and uploaded to your Turen organization. Sessions capture:
  • All user messages and assistant responses
  • Tool invocations and their results
  • Token usage and timing data
Sessions are encrypted with your organization’s unique encryption key before storage. Only members of your organization can decrypt and view them.

​
Data Flow

All communication between the agent and Turen Cloud uses HTTPS. Session data is encrypted at rest with AES-256-GCM using per-organization keys. See Security Architecture for details.