Security & data

Answers you can stand behind. Documents that don't linger.

Questionnaire answers become representations in a contract. Everything about how Turnflow works is built so that nothing in your file needs to be walked back, and nothing you upload stays longer than it has to.

Standards

Four rules every answer passes

Rule 01

No citation, no answer

An answer without a quoted source in your documents is never written into the file. It's left blank for you, with the reason.

Rule 02

Quotes are checked, not trusted

Every quote is matched against the text of the page it claims to come from. A quote that can't be found is removed, and the answer goes back for review.

Rule 03

Auditor exceptions are disclosed

If your auditor found that a control didn't operate as described, the answer says so instead of a clean "Yes".

"Partial: 2 of 25 sampled terminations were revoked late (CC6.3, p.4)."

Rule 04

Your own description isn't proof on its own

A statement that appears only in management's system description, and was never tested by the auditor, is marked for confirmation rather than presented as verified.

Retention

How long anything is kept

Your uploads and the completed file are deleted automatically 14 days after delivery. Download links in emails stop working after 7 days; you can still download from your workspace until the files are deleted.

Processing

Email link active · 7 days

Workspace download

UploadDeliveredLink expiresDeleted · day 14

Access

Who sees what

You. Your workspace lists only requests made from your Google account. Another account can't see them or download their files.
Your reviewer. The person checking your answers sees your files and the drafted answers. Each request is processed on its own; nothing from other clients' documents is mixed in.
Nobody else. Your documents are used only to complete your request. They aren't shared with other clients, sold, or used to train models. The subprocessors page lists every provider that hosts or runs the service.
Reviewer access. The review console is protected by a password, and every action on a request is recorded in its history.

Sign-in. Google sign-in shares only your name and email address. There is no Turnflow password to leak.
Private links. Download links are long random tokens that are never stored in readable form, and they expire.
Before you upload. Only send documents you're permitted to share. If your SOC 2 report is under NDA, check that its terms allow sharing with a processor acting for you.