Trust center
How Turm protects your VMs and your data. Everything on this page describes how the service runs today; where we have not built something yet, we say so.
Data location
All VMs, disks and the control plane run on servers in Falkenstein, Germany.
Isolation
Every VM is its own KVM virtual machine with its own kernel, not a container.
Encryption in transit
TLS 1.2+ for web traffic, SSH for shell access.
SOC 2
In progress. Not certified.
Infrastructure and data location
- The control plane, its database and every VM disk are on dedicated servers we rent from Hetzner in its Falkenstein data centre in Germany.
- Our DNS is on Cloudflare in DNS-only mode, so traffic to the service and to VMs goes straight to our servers, not through a third-party proxy.
- The few third parties that handle personal data are on the sub-processor list.
VM isolation
- Each VM runs under Cloud Hypervisor on KVM, with its own guest kernel, memory and disk. The hypervisor runs as an unprivileged user with no Linux capabilities and applies its own seccomp filters.
- Host firewall rules drop traffic between VMs and drop any packet a VM sends with an address that is not its own.
- Outbound mail ports (25, 465, 587) are blocked for every VM.
- Each VM generates its own SSH host keys on first boot; no host keys are baked into images.
- A VM's web address is private to its owner until the owner shares it or makes it public.
- Credentials you add for integrations, such as a GitHub token, never enter the VM: the platform adds them to the VM's outgoing requests at the network edge.
Encryption
- Web traffic to the dashboard, API and VMs uses TLS 1.2 or later, with certificates from Let's Encrypt. Plain HTTP is redirected to HTTPS.
- Shell access to VMs is over SSH.
- Integration credentials are encrypted with AES-256-GCM before they are stored.
- Not yet: VM disks are not encrypted at rest by us. If you need that, encrypt data inside your VM.
Access control
- You sign in with SSH keys or email links. There are no passwords.
- Session IDs and login links are stored only as SHA-256 hashes, so a copy of the database is not enough to sign in to the dashboard. A share-link token is stored as itself, so that copy can open a VM shared by link.
- The dashboard session cookie is host-only, HttpOnly, Secure and SameSite, and is removed from requests before they reach your VM. State-changing requests from other sites are rejected, and sign-in attempts are rate limited.
- Our servers accept administrator logins only with SSH keys, on a non-standard port, behind a host firewall and with brute-force blocking. Packages receive automatic security updates.
Availability and backups
- Server disks are mirrored across two NVMe drives (RAID 1).
- Each VM disk is copied to a point-in-time replica every few seconds, on the same server.
- The database is dumped every day; the last seven days are kept.
- Deleting a VM deletes its disk, replica and console log.
- Not yet: copies on a second server or off-site. Keep your own backups of data you cannot lose.
Monitoring and incident response
- Better Stack requests the public pages from outside. The result is on our status page at turm.betteruptime.com.
- Incident notes are posted on that status page and in
/status.json. The runbook is acknowledge, post the note, mitigate, and write a postmortem within 48 hours. - If a personal data breach affects your data, we notify you without undue delay, as set out in the DPA.
Secure development
- Every change runs static analysis, a vulnerability scan of dependencies (govulncheck) and a security linter (gosec) in CI.
- We keep a software bill of materials for the platform in CycloneDX format.
- Cloud Hypervisor, its client, the guest kernel source, wal-g and restic are pinned to exact versions and checked by SHA-256. Other packages come from the distribution, without a checksum of our own.
Compliance
| Framework | Status |
|---|---|
| GDPR | Data hosted in the EU. A Data Processing Agreement under Art. 28 is part of every account. |
| SOC 2 | In progress |
SOC 2 in progress. We have not been audited, and this is not a certification. We will update this page when that changes.
Responsible disclosure
If you find a vulnerability, email hi@turm.dev with "security" in the subject. Include what you found and how to reproduce it. Please do not access other customers' data, degrade the service, or share details publicly before we have fixed it. We will acknowledge your report and keep you updated.