Your own cloud environment
TurnFriendly runs in a separate private cloud environment for your organisation. We agree the configuration to match your requirements.
Security & Compliance
Handle customer cases securely and transparently.
Protect customer data and control who can access which information. TurnFriendly combines defined permissions with encryption and traceable operational processes.
For IT, information security, data protection and service managers.
Protection built into everyday operations
Protect customer data
Encryption and separate cloud environments.
Manage access
SSO through your identity provider and managed permissions.
Protect operations
Backups, controlled updates and logging.
Protecting customer data
Security at several levels
The existing cloud deployment runs in the OCI Frankfurt region. We agree the specific configuration and your contractual requirements for the chosen environment.
Encrypted data
Encrypted connections protect data in transit. Database contents and backups are also encrypted.
Controlled access
Your team signs in through your organisation's identity provider. Roles and user profiles control the available data and functions.
Information security
Evidence and current status.
TISAX assessment
TurnFriendly has completed its TISAX assessment. TISAX is an assessment and exchange mechanism for information security. We’ll discuss scope and evidence as part of your supplier review.
ISO 27001: certification in progress
ISO 27001 certification is currently in progress. TurnFriendly has been implementing the standard since July 2026 and continues to develop its information security management.
DORA self-assessment
The DORA self-assessment describes documented responsibilities and a structured approach to information security risks. An information security report issued at least annually summarises risks, assessment findings and improvement measures. Security documentation and an access control concept are available for your supplier review.
Defined operational processes
Keep track of security throughout operations.
Backups, controlled changes and traceable events complement the protection of your customer data. Technical details and points for individual agreement are available below.
Back up and recover data
Backups support data recovery. We agree retention, recovery objectives and additional backups for your environment.
Review and approve changes
New versions undergo review, testing and approval. Application components are checked for known vulnerabilities during development.
Trace security events
Logs make security-related events traceable. We inform affected customers about identified vulnerabilities.
View operational and security details
The following technical details describe the existing Private Cloud deployment. We agree configuration, security and backup requirements for your environment. The agreed services apply.
Dedicated deployment
For an agreed dedicated deployment, your organisation receives its own OCI compartment with a network, application cluster and database. Network controls and access policies logically separate the environments.
Backups, recovery and data export
The standard cloud configuration includes automatic database backups retained for 60 days and point-in-time recovery. TurnFriendly also creates a weekly long-term full backup retained for 365 days.
- Arrange optional cross-region backups and Autonomous Data Guard
- Define recovery objectives and retention periods in the contract
- Have customer data exported with the TF Cloud Exporter
Encrypted data
Data transfer is encrypted: TLS 1.3 protects connections through Myra to the application. The database connection is also encrypted. The database and backups use AES-256 encryption.
Controlled access
Application users sign in through your company's identity provider and SSO service. TurnFriendly supports SAML and OIDC. Authorised administrators on the customer side control application permissions. User profiles govern data views, report permissions and reimbursement authority.
In cloud operations, technical accounts receive only the permissions they need. TurnFriendly’s administrative OCI access is protected by multi-factor authentication. Myra Web Application Firewall and DDoS Protection complement the network controls.
Deploy updates under control
New application versions and security-related changes go through review, testing and approval. TurnFriendly monitors application components for known vulnerabilities during development.
Log security events
Audit, API activity and service logs are recorded through OCI Logging. Audit logs are retained for 365 days. Retention periods for other logs can be agreed individually.
Keep customers informed proactively
TurnFriendly informs customers about identified vulnerabilities that could affect production systems. If these cannot be resolved promptly, a defined escalation process applies. Customers receive monthly availability and service quality reports.
Where does TurnFriendly Cloud run?
TurnFriendly SaaS is deployed in the commercial OCI Frankfurt region by default. Oracle provides cloud infrastructure. Myra provides the Web Application Firewall and DDoS protection. Customer-operated mail, identity and integration services are agreed during onboarding.
Which requirements do we agree individually?
These include application roles, support access approvals, customer-managed keys, backup options, recovery objectives, and retention and deletion processes. The specific configuration and contractual requirements are defined together.
Your next step
What does your security review require?
Discuss your requirements for data storage, access, encryption and recovery with us. Together, we clarify what needs to be reviewed and who can address the technical details.