All customer data is encrypted at rest with AES-256 and in transit with TLS 1.3. Encryption is always on — there's nothing to enable. Enterprise plans can bring their own key (BYOK) and add end-to-end encryption for regulated workloads.
At rest
Golden DB records, agent activity logs, and account artifacts are encrypted at rest with AES-256. Keys are managed through a KMS with regular rotation. Backups are encrypted with the same standard. There is no unencrypted copy of customer data at rest.
In transit
Every connection — API calls, dashboard traffic, database connections, integration sync — uses TLS 1.3 as the minimum. Older TLS versions are rejected. Webhook deliveries are signed so you can verify integrity as well as confidentiality (see Webhook signature verification).
Bring your own key (BYOK)
Enterprise plans can supply and control their own encryption key through the KMS integration, so you can revoke turgo's ability to decrypt your data on demand. This is common for regulated industries with key-custody requirements. Set it up with your account team.
End-to-end encryption
For highly regulated workloads, optional end-to-end encryption is available on Enterprise so certain fields are encrypted before they reach turgo's storage. This trades some in-product functionality (fields that must stay encrypted can't be used in agent reasoning) for maximum confidentiality.
