Privacy Policy
These terms are in force and govern your use of the Turbo Governance System today. They were drafted in-house against how the software actually works rather than copied from a template, and they have not yet been reviewed by outside counsel. We will revise them before the Turbo Governance System is generally available, and we would rather say so plainly than let you assume a review happened that has not. Nothing on this page is legal advice to you, and nothing on it overrides a separate signed agreement between your organization and TurboClientSystems, Inc.
1. Scope, and our role in your data
This Policy covers the Turbo Governance System web application and its public pages. It does not cover Microsoft 365, SharePoint, Microsoft Entra ID, or any other service your organization uses, each of which is governed by your organization’s own agreements with its provider. Our role differs depending on which information is at issue, and the distinction matters for your rights. For the compliance data, evidence, submissions, comments, role assignments, and audit records your organization creates through the Service, your organization is the controller and decides what is collected, who may see it, and how long it is kept; we are not a processor of that data in the usual sense, because it never reaches us. It moves directly between your browser and your own Microsoft 365 tenant. For the limited information involved in signing you in and serving you the application, we act as controller. Requests about the first category should go to your organization’s administrator; requests about the second can come to us.
2. Information we collect
When you sign in, your browser receives account and profile information from your organization’s identity provider (Microsoft Entra ID), your name, email address, user ID, tenant/organization identifier, and, where you have one set, your profile photo. That information is used in your browser and, where you record something, written into your own tenant; it is not transmitted to us. The compliance data, configuration, evidence files, generated documents, exam submissions and their answers, comments and @mentions, role assignments, and append-only audit entries you or your colleagues create are stored in your organization’s SharePoint site, each attributed to the identity of the person who created it. The Service does not use analytics, product-usage tracking, session recording, advertising, or third-party error reporting, and it makes no network requests to any host other than Microsoft’s sign-in and Graph endpoints, your organization’s SharePoint domain, and its own origin, an enforced browser policy, described in Section 10, blocks anything else. What we do necessarily have is ordinary web-server information: our hosting provider records standard request logs when your browser loads the application, including IP address, timestamp, requested URL, and user-agent string. When your organization’s administrator installs a version of the governance library through the Portal, the Portal downloads that one library file from our origin, and our hosting provider’s request logs record that download like any other request. The file is the same for every organization, and the Service does not ask our servers for any governance content when someone views it, because it reads the installed copy from your organization’s own SharePoint site. We use those logs only to deliver, secure, and troubleshoot the site. If you write to us through the contact form on our public pages, we receive what you submit, your name, email address, the optional phone number and company you choose to give, and your message, and use it only to answer you and keep a record of the request in that mailbox.
3. Directory information about other people
Some features read limited information about other people in your organization. When you open the people picker to assign a governance role or @mention a colleague, the Service searches your organization’s directory and displays matching names, email addresses, and profile photos. This happens in your browser, using your own delegated permission, against your own tenant; the results are not sent to us. If you then save an assignment, mention, or access grant, the names and email addresses of the people involved are written into your organization’s own SharePoint lists as part of that record, where they are retained under your organization’s control. Your organization is responsible for whatever notice or consent its own employees are owed for that.
4. How we use information, and our legal bases
Information handled through the Service is used to authenticate you and enforce access controls; to display and organize your organization’s compliance data and attribute records to the person who created them; to keep your preferences and session working across page loads; to communicate with you about the Service; and to deliver, secure, and troubleshoot the application itself. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it to develop or train models. Where the UK or EU General Data Protection Regulation applies, our legal bases for the limited processing we perform as controller are the performance of a contract with you (delivering the application and signing you in) and our legitimate interests in operating and securing the Service, balanced against your rights.
5. Cookies and browser storage
This website stores one item in your browser: a record of your answer to its storage notice. It is kept in localStorage under the key "tcs-consent" and holds the day you answered (no time), the version of the notice, and a flag for each of four categories (marketing, Microsoft identity, statistics, storage), all set to refused. Nothing on this website writes anything else to your browser, so the notice offers nothing to switch on. The record stays in your browser and is not sent to us. It expires after 395 days, when the notice shows again, and you can remove it sooner by clearing this site’s data in your browser. The "Storage notice" link in the footer shows the notice again, and dismissing it again writes nothing. This website has no sign-in, and our own code on it sets no cookie and runs no analytics or advertising. The Vercel BotID script described in Section 8 is Vercel’s code, and we have not verified what, if anything, it stores in your browser. The application you reach through "Log in" is a separate site with its own browser storage. It stores, in your browser and as it needs them, your Microsoft sign-in session, a local copy of your display settings (theme, density, text size) that it reads when a page first loads, a copy of your tenant’s configuration, and a copy of the governance library your administrator installed. The application shows no storage notice or preferences dialog, because it has no optional category to ask about: it runs no marketing or usage analytics. You can remove everything it stores by clearing that site’s data in your browser. The application’s own code sets no cookie, and its fonts, like this website’s, are served from our own origin rather than from a font provider.
6. Microsoft Graph permissions we request
The Service asks for a deliberately small set of delegated Microsoft Graph permissions, always under your own signed-in identity and never as a service account. Signing in requests only the ability to read your basic profile and to access the one SharePoint site your organization has explicitly granted, a scope that resolves to the intersection of "this application was granted this specific site" and "you already have access to it," so it cannot reach any other site in your tenant. Three further permissions are requested separately, only at the moment a feature needs them: reading your organization’s branding, to prefill your logo in settings; reading basic profile information for other people, to power the role-assignment people picker; and reading your own group memberships, to check whether you hold a role in the Service. Each permission, and the reasoning for choosing the narrower option over the broader one, is listed individually on our public Permissions page. Setting up the Service initially requires an administrator to grant admin-consented permissions and to provision the SharePoint site. That setup is done in the Turbo Client Systems Portal, not in the Service; as described in the Terms, the Service itself holds no elevated permission and no standing credential in your tenant.
7. Where your data lives
Your organization’s compliance data is stored entirely within your organization’s own Microsoft 365 tenant. Its physical location, encryption, residency, and regulatory treatment are inherited from your organization’s own Microsoft 365 configuration and agreements with Microsoft; they are not controlled, chosen, or warranted by us. Each deployment of the Service is configured for a single Microsoft cloud, commercial, Government Community Cloud High, or DoD, to match your environment. The application itself is served from a commercial web hosting provider, which is where the request logs described in Section 2 are generated; that provider never receives your compliance data or your Microsoft access token.
8. Service providers and sub-processors
We keep this list short by design, and it is complete as of the effective date of this Policy. Microsoft provides identity, Graph, and SharePoint services, under your organization’s own agreements with Microsoft rather than ours. Vercel Inc. hosts and serves the Turbo Governance System web application and generates the standard request logs described in Section 2. Microsoft also delivers the messages you send through our contact form to us, through our own Microsoft 365 mailbox and under our own agreement with Microsoft, and so receives what you submit in that form. The contact form is also guarded by Vercel BotID at its Basic level: a script from Vercel runs in your browser on this site’s pages and attaches a challenge answer to the request when you send the form, and Vercel checks that the answer is valid to tell people from automated tools. Vercel shows us the result of each check in the firewall view of our project, and we have not verified how long Vercel keeps it. We do not enable BotID’s Deep Analysis level, which analyzes additional client-side signals and is provided by Kasada. Google Fonts typefaces are used, but the font files are bundled into the application and served from our own origin at build time, so your browser makes no request to Google when you load a page. We do not use an analytics provider, an advertising network, a customer data platform, an error-monitoring service, a CRM, or an email marketing platform in connection with the Service. If that changes, we will update this section and, where consent is required, ask for it before anything is collected.
9. Data retention and deletion
Compliance data, configuration, evidence, documents, submissions, comments, and audit records reside in your organization’s own SharePoint site and are retained according to your organization’s own retention policies, backup settings, and administrative decisions, we neither set nor enforce a retention period for them, and we cannot delete them for you. Two points deserve emphasis. First, the audit log the Service maintains is append-only by design: entries record who performed each write, to what, and when, and are never modified or deleted by the Service, because a compliance trail that can be edited is not a compliance trail. Your organization controls that list in SharePoint and can remove it, but should weigh that against its own evidentiary needs, and should treat it as a record containing personal data when responding to a deletion request. Second, information stored in your browser is retained only on your device, until you clear the site’s data in your browser, apart from the consent record, which also expires after 395 days. Hosting request logs are retained by our hosting provider for a limited period under its standard practices and are used only for delivery, security, and troubleshooting. A message you send through the contact form stays in our Microsoft 365 mailbox, and this Policy does not state a deletion period for it. To have a message deleted, submit a privacy request through the same form. We hold no separate database of your organization’s compliance data to retain or delete.
10. Security
The Service is built so that a security failure has as little to reach for as possible. There is no server-side database of customer data, no service account in your tenant, and no standing credential of ours anywhere, which removes an entire category of breach rather than promising to prevent it. Your Microsoft access token is held only in your own browser: in browser storage, and where the application keeps it follows the keep-me-signed-in-across-tabs choice you make there. The application enforces a strict Content Security Policy that confines every network request the page can make, including background requests, form submissions, image loads, and frames, to Microsoft’s sign-in and Graph endpoints, your organization’s SharePoint domain, and our own origin, so that even a hostile script running on the page would have nowhere to send a token. Traffic is served over HTTPS with strict transport security, and the application sets browser hardening headers including a strict referrer policy, framing restrictions, and a permissions policy disabling device APIs the Service does not use. No system is perfectly secure, and this is pre-release software. If we become aware of a security incident affecting information we hold, we will notify affected users and, where required, regulators without undue delay; if an incident affects data in your own tenant, your Microsoft 365 environment’s own logging and notification mechanisms, not ours, are what will show it, which is another reason your administrator’s configuration matters.
11. Exam submissions and personnel records
Some features record information about identifiable employees. A completed exam or assessment is saved with the submitter’s name, email address, timestamp, and answers, both as a structured record and as a generated document. Role assignments, access-grant records, and comments are likewise attributed by name and email. In many jurisdictions this is employee or personnel data with heightened handling expectations, and in some it may support decisions about an individual. All of it is created by your organization, stored in your organization’s tenant, and controlled by your organization; we neither receive it nor make any decision using it. Your organization is responsible for providing employees with any required notice, for restricting access appropriately, and for handling requests those individuals make about it.
12. Your privacy rights
13. International transfers
The Service is operated from the United States, and the limited information we handle as controller, principally the hosting request logs described in Section 2, is processed there. Where your compliance data is stored and processed is determined entirely by your own Microsoft 365 tenant’s configuration and your organization’s agreements with Microsoft, including any transfer mechanism those agreements provide. If you access the Service from outside the United States, you understand that delivering the application to you involves processing in the United States.
14. Children’s privacy
The Service is intended for use by working professionals aged 18 or older, on behalf of their organizations, using a work or school account. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a minor has used the Service, contact us and we will address it.
15. Changes to this Policy
We may update this Policy from time to time. When we do, we will change the effective date shown at the top of this page, and for material changes we will make reasonable efforts to give additional notice through the Service. Changes apply prospectively. Continued use of the Service after a change takes effect constitutes acceptance of the revised Policy. You should review this page periodically.