Skip to main content
Turen uses multiple layers of encryption to protect your organization’s data.

​
Encryption in Transit

All communication between Turen components uses TLS 1.2 or higher: Claude Code connects directly to the Anthropic API over HTTPS. Turen does not sit in the path of your LLM traffic.

​
Encryption at Rest

​
Session Data

Session recordings are the most sensitive data Turen handles. They are protected with envelope encryption:
  1. Organization key (DEK): Each organization has a unique AES-256-GCM Data Encryption Key
  2. AWS KMS (KEK): The organization key is itself encrypted by AWS Key Management Service
  3. Per-session encryption: Each session is encrypted individually with the organization’s DEK
To read a session, Turen must:
  1. Retrieve the encrypted DEK from the database
  2. Decrypt it via AWS KMS
  3. Use the DEK to decrypt the session data
This means even if S3 storage were compromised, session data would be unreadable without access to both the database and AWS KMS.

​
Agent Credentials

Agent secrets (as_live_) are stored on the developer’s machine in a state file encrypted with a machine-bound key. The encryption key is derived from hardware identifiers, so the state file cannot be decrypted on a different machine.

​
Database

The PostgreSQL database uses encryption at rest provided by the hosting provider (Supabase). All sensitive fields (secrets, keys) are stored as hashed or encrypted values.

​
Key Management

​
Data Residency

All Turen infrastructure runs in AWS us-east-1. Session data, telemetry, and metadata are stored in this region. Contact us if you have specific data residency requirements.