Last Updated: July 28, 2026
This statement explains how Turbopush protects your data and secures the over-the-air update platform.
Security is fundamental to an over-the-air update platform. This statement provides a public overview of the technical and organizational measures Turbopush ("Turbopush", "we", "us", or "our") uses to protect the confidentiality, integrity, and availability of the Service.
This statement is informational. It is not a service level agreement, warranty, or guarantee that every security event can be prevented. Data processing terms are available upon request. Our contractual commitments are set out in our Terms of Service and Privacy Policy.
We are committed to processing personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
We process personal data fairly, transparently, and only for specified and legitimate purposes. We do not sell personal information. The rights available to you under GDPR and CCPA are described in our Privacy Policy.
Subscription payments are processed by Stripe, which is a PCI Service Provider Level 1. Turbopush does not receive or store full payment card numbers or card security codes in its systems.
Turbopush does not currently hold SOC 2 or ISO 27001 certification. SOC 2 and ISO 27001 are on our roadmap. We will update this page as our compliance program develops.
The Service is hosted on Cloudflare’s global edge network, which provides distributed delivery, denial-of-service mitigation, and a web application firewall for public endpoints.
Data processed by the Service is stored and processed on Cloudflare’s global network, with infrastructure primarily located in the United States. A specific data-residency commitment applies only when agreed in writing.
All traffic between your applications, the Service, and our infrastructure is protected in transit using HTTPS/TLS 1.3. We apply security headers (including Content Security Policy and HTTP Strict Transport Security) and enforce rate limiting on public endpoints to protect against abuse.
We seek to minimize the personal and customer data we process. Data is encrypted in transit using HTTPS/TLS 1.3 and encrypted at rest using AES-256 encryption provided by our Cloudflare-managed infrastructure.
We store account, organization, application, deployment, and release metadata, together with delivery metrics, as required to operate the Service. We do not require access to your source code repository to deliver an OTA update.
When you delete your account or data, we delete or anonymize the associated information within a reasonable timeframe, except where retention is required by law.
You can sign in to the Service using email and password, or through Google or GitHub. When you sign in through a third-party identity provider, we do not receive or store the password used with that provider. The Service also supports multi-factor authentication to further protect your account.
Organization access is managed through role-based access control. Access to internal systems and production resources is granted on a need-to-know basis following the principle of least privilege, and is removed when no longer required.
Access keys and deployment keys are generated using a cryptographically secure random number generator. We log account and API activity to support monitoring and troubleshooting, and recommend that customers rotate keys regularly and store credentials in a secrets manager.
Update bundles are delivered over encrypted connections. Each release is fingerprinted with a SHA-256 content hash so that the integrity of delivered updates can be verified.
Turbopush supports optional code signing: you sign releases with your own private key, and the SDK verifies the signature on-device before an update is installed. This protects your users against man-in-the-middle attacks and tampered updates.
We use version control and documented development workflows to track changes. Changes to production services are reviewed and tested before deployment, and we use automated dependency and vulnerability scanning to identify and remediate risks.
We collect operational, security, and diagnostic information to operate the Service, detect anomalies, and investigate incidents. Monitoring is used to identify availability issues and suspicious activity.
All data is automatically backed up with continuous replication, designed for long-term durability to protect against hardware failure and data loss.
We maintain processes to identify, investigate, contain, and remediate security incidents, and to communicate with affected users.
In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify affected users without undue delay through the email address associated with their account.
We engage a limited set of trusted third-party providers to operate the Service:
If you believe you have found a vulnerability or security issue, please report it to security@turbopush.org. Include enough information to help us reproduce and investigate the issue, and do not access another user’s data or publicly disclose the issue before we have had a reasonable opportunity to investigate.
If you have questions about our security practices, or if you need data processing terms, please contact us at security@turbopush.org.
