Security & compliance
Built for work that auditors will read.
TurboProject was designed for regulated change: every action is attributed, every file is hashed and every change is on the record.
Integrity & audit
- Append-only, hash-chained audit log for every change
- Audit chain verification on demand
- Files content-addressed by SHA-256; changes are detectable
- Evidence attributed to a person or a named system token
- Optional object lock (S3) or immutability policies (Azure)
Identity & access
- Single sign-on with any OpenID Connect provider
- Role-based access control per project, group and customer
- External users only see customer-visible or routed items
- Leavers disabled automatically when deactivated in the IdP
- Personal API tokens with expiry, revocable at any time
Data protection
- Sessions in HttpOnly cookies; IdP tokens encrypted at rest (AES-GCM)
- Integration secrets encrypted, write-only and audited
- Bring your own S3-compatible or Azure Blob storage
- Deleted users anonymised while the audit trail stays intact
- Data processing agreement available from ZeroSubnet AS
Compliance support
- Completed tasks linked to ISO 27001 and NIS2 controls
- Coverage report: covered, partial and missing controls
- Four-eyes verification of evidence
- Mandatory approvals and evidence before tasks can close
- GDPR: EU/EEA-based supplier with a Norwegian controller
Security questionnaire or DPA?
We're happy to answer security questionnaires, share our data processing agreement and list of sub-processors, and walk your security team through the architecture.
Ready to put your projects in motion?
See TurboProject on your own change process in a 30-minute walkthrough. No slides, just the product.