Security & Compliance

Hosting

All customer data is hosted exclusively in the region you select. Customer data inserted into one region remains in that region, except when requested by the customer via the turbopuffer API. Customer data and usage data is always encrypted in transit with TLS1.2+. Customer data is always encrypted at rest with AES-256, and optionally with a customer's key.

SOC2

turbopuffer undergoes System and Organization Controls (SOC) 2 Type 2 audits of the design and operational effectiveness of security and availability controls.

You can request a copy of the latest SOC 2 report and Penetration Test from our Trust Center.

Data Protection (GDPR & CCPA)

turbopuffer provides a Data Processing Addendum (DPA) for all customers to enable compliance with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The DPA describes our commitment to policies that comply with the requirements of privacy laws on data processors, such as data deletion, breach notification, and subprocessor management policies.

We're happy to assist with any additional questions you may have as part of your privacy compliance processes.

HIPAA

Customers who wish to store protected health information (PHI) in turbopuffer may request a Business Associate Agreement (BAA) with turbopuffer, under which turbopuffer commits to compliance with the requirements of HIPAA on business associates that store and process PHI.

Contact us if you require a BAA or have further questions.

Vulnerability Disclosure

See our Vulnerability Disclosure policy.

Tenant isolation

turbopuffer is designed to provide robust data isolation between tenants, even when workloads from multiple tenants are colocated on the same turbopuffer cluster and share the same physical hardware.

Unlike many other multi-tenant systems, turbopuffer logically separates tenants at the storage layer. Every data file is written to a tenant-specific prefix on object storage and contains data from only that tenant. No file ever contains data from multiple tenants. This separation is maintained in the memory and disk caches: each cache entry is identified with a tenant-specific prefix and contains data only for that tenant.

When a request arrives:

  1. The router layer authenticates the request and resolves the API key to its tenant ID.
  2. The query layer executes within the context of this authenticated tenant ID, and is constrained so that it can only construct file paths within the authenticated tenant's prefix.
  3. The cache and storage layers can therefore only provide data from files belonging to the authenticated tenant ID.

This design enforces the tenant isolation control consistently across a small number of tested and well-audited components: request authentication, tenant ID propagation, and storage path construction.

Customers who require strict physical isolation of tenant data may consider provisioning a dedicated turbopuffer cluster (i.e., separate physical hardware) for each tenant. However, this comes with significant cost and operational overhead. For most customers, turbopuffer's application-level logical tenant isolation provides sufficient data isolation guarantees.

Customer managed encryption (CMEK)

turbopuffer offers support for customer managed encryption keys (CMEK), allowing customers on the Enterprise plan to ensure their data is encrypted using keys from their Key Management System (KMS)/Enterprise Key Manager (EKM).

This also allows customer's customers to use their own KMS to encrypt their data, as the encryption key is defined at the namespace level.

This gives a customer or a customer's customer the same control over their data as they would have if they were to host their own data in their own bucket.

Get started with CMEK.

Private networking

turbopuffer supports private network connections between customer VPCs and our multi-tenant regions. This feature is available to customers on the Enterprise plan.

Get started with private networking.

IP allowlisting

turbopuffer supports organization-level IP allowlisting to restrict API access to approved IP addresses or CIDR ranges. Requests reaching the organization through a public turbopuffer endpoint are rejected unless their source IP falls within an allowed range. IP allowlisting is currently available on the Scale and Enterprise plans.

Contact us to enable IP allowlisting for your organization.

Single Sign-On (SSO)

turbopuffer supports Single Sign-On (SSO) for dashboard access on the Scale and Enterprise plans.

Contact us to enable SSO for your organization.

Privileged access management

turbopuffer only accesses customer data with the customer's written consent, except where necessary to respond to an incident that impacts the availability or security of the platform. All access is logged, including the accessor, the resources accessed, and the reason. For single-tenant clusters, infrastructure-level controls prevent any turbopuffer employee from accessing customer data or systems without internal approval.

Privileged access management is available as an add-on that gates access behind multi-party approval, enforces time limits on approved sessions, and exposes the audit log to customers. turbopuffer can customize these policies to meet your security requirements.

Contact us to enable privileged access management.

Subprocessors

turbopuffer discloses every vendor that processes customer data, covering infrastructure, platform, and optional feature subprocessors, on the dedicated subprocessors page, along with a subscription for update notifications.