Authentication, Program membership and Local Admin settings determine who can work with customer content.
Security & IT
Industrial trust starts with clear boundaries.
Turnover is designed around authenticated Program access, customer-controlled administration, scoped permissions, bounded intelligent retrieval, controlled exports, deliberate external-participant workflows, and strict Turnover-controlled administrative access. We describe the controls we actually use and do not claim certifications that have not been established.
Customer Data remains customer dataTurnover-controlled backend/customer-data access requires U.S. citizenship and satisfactory fingerprint-based FBI criminal-history screeningLeroy and Auto Jobs stay inside configured authority boundaries
Trust boundaries
Customer DataCUSTOMER
Customer-owned operational, technical, form, file, and work information.
Leroy + TurnBaseSCOPED
Authorized evidence only. No silent AI commit or export authority.
External participationBOUNDED
Assigned workflow or tokenized form path, not normal Program access.
For plant leadership and IT reviewers
Three boundaries to understand first.
Leroy and automated assistance operate within configured evidence and access boundaries. Authorized people remain responsible for decisions.
Turnover is not a protective control, emergency dispatch or a replacement for qualified judgment.
Give the right people the right path.Turnover separates account authentication, Program authorization, Local Admin responsibility, and feature-specific permissions so one access decision does not have to open every part of the system.Technical explanation
Access and administration
Give the right people the right path.
Turnover separates account authentication, Program authorization, Local Admin responsibility, and feature-specific permissions so one access decision does not have to open every part of the system.
Authenticated Program users
Normal internal users sign in through approved authentication and must be authorized for the target Turnover Program before they can work inside it.
Customer Local Admin control
Customer-designated Local Admins manage supported Program access, roles, Work Groups, page visibility, and other configuration controls for their organization.
Feature-specific boundaries
Reviewer authority, Work Group and Persona scope, page access, export permissions, and other specialized controls remain separate from basic Program entry.
Backend and Customer Data access is restricted to screened U.S. personnel.Turnover does not grant Turnover-controlled access to backend systems or identifiable Customer Data to a person unless that person is a U.S. citizen and has completed a fingerprint-based FBI criminal-history background check with satisfactory results. Access i…Technical explanation
Turnover-controlled administrative access
Backend and Customer Data access is restricted to screened U.S. personnel.
Turnover does not grant Turnover-controlled access to backend systems or identifiable Customer Data to a person unless that person is a U.S. citizen and has completed a fingerprint-based FBI criminal-history background check with satisfactory results. Access is still limited by job need and the duties required to support or secure the service.
- U.S. citizenship is required before Turnover-controlled backend or identifiable Customer Data access is granted
- A fingerprint-based FBI criminal-history background check with satisfactory results is required before that access is granted
- Access should remain need-based rather than being granted simply because someone works with Turnover
- Customer Program permissions remain separate from Turnover's own administrative-access controls
Turnover personnel boundary
CitizenshipREQUIRED
U.S. citizenship is required for Turnover-controlled backend or identifiable Customer Data access.
Background screeningREQUIRED
A fingerprint-based FBI criminal-history background check with satisfactory results is required before Turnover grants that access.
Need to knowLIMITED
Meeting the screening requirements does not itself create a right to access Customer Data or backend systems.
Scope of this commitment. This describes access Turnover itself grants to its personnel. Infrastructure, hosting, communications, payment, and other service providers operate under their own contractual and security controls.
Intelligence should not become a permission shortcut.Leroy uses a proprietary in-house reasoning and retrieval architecture designed to prioritize speed while preserving source identity and authorization boundaries. TurnBase is a structured, permission-aware and freshness-aware knowledge repository. Auto Jobs op…Technical explanation
Leroy + TurnBase + Auto Jobs
Intelligence should not become a permission shortcut.
Leroy uses a proprietary in-house reasoning and retrieval architecture designed to prioritize speed while preserving source identity and authorization boundaries. TurnBase is a structured, permission-aware and freshness-aware knowledge repository. Auto Jobs operate through configured Program scope and do not receive unlimited authority simply because they are automated.
- Leroy prefers exact Turnover evidence and source identity where available
- Connected intelligence remains read-only unless an existing Turnover workflow explicitly owns a commit
- TurnBase knowledge is bounded by Program, Work Group, Persona, and other applicable authority
- Core TurnBase export remains permission-scoped; advanced Context Packets do not broaden what the user is allowed to read
- Auto Jobs and automatic notifications evaluate configured conditions inside supported scope rather than receiving unrestricted Program authority
Intelligence authority model
RetrieveAUTHORIZED
Use the smallest relevant evidence set the user or configured job is permitted to access.
ReasonSOURCE AWARE
Keep record, package, revision, scope, and freshness identity available where the source supports it.
ChangeCONTROLLED WORKFLOW
AI or automation does not silently create, verify, delete, export, approve, or overwrite authoritative Program data outside the workflow that owns the action.
Outside participation can be useful without opening the Program.Turnover supports more than one limited outside-workflow pattern. The important rule is that an external participant receives the path needed for the assigned work, not normal access to unrelated Program data.Technical explanation
External participation
Outside participation can be useful without opening the Program.
Turnover supports more than one limited outside-workflow pattern. The important rule is that an external participant receives the path needed for the assigned work, not normal access to unrelated Program data.
Tokenized external forms
Where a company template allows external participation, Turnover can issue a high-entropy tokenized form link with expiration, revocation, replay protection, rate limits, server-side validation, and private submission storage.
Internal review stays internal
The external participant completes the assigned form. The returned submission is synchronized back into the controlled form for internal review and any configured approval chain.
Limited contributor workflows
Where configured, approved contractors or specialists may use a limited contributor workspace for assigned submissions without receiving normal access to protected internal modules.
Export bounded context, not the keys to the operation.Turnover supports deliberate, permission-scoped export of authorized customer-owned information for approved external analysis. Core TurnBase users can export authorized knowledge. Intelligence can build richer Context Packets from relevant TurnBase and connec…Technical explanation
External AI workflows
Export bounded context, not the keys to the operation.
Turnover supports deliberate, permission-scoped export of authorized customer-owned information for approved external analysis. Core TurnBase users can export authorized knowledge. Intelligence can build richer Context Packets from relevant TurnBase and connected Program evidence. External models still do not receive unrestricted live Program authority.
- Safety Form AI kits describe the allowed template schema and instruct the model not to invent company policy
- Inventory AI/Data workflows can return proposed structured items for authorized review rather than writing live stock directly
- A returned AI result must pass through the applicable Turnover review/import workflow
- If a Customer sends exported data to a third-party AI service, that third party's terms and data handling also matter
BOUNDARY
Turnover ProgramCONTROLLED
Authenticated users, permissions, authoritative records, and customer configuration remain inside Turnover.
Explicit exportBOUNDED
Only the selected schema or authorized package is prepared for the outside task.
Review before useREQUIRED
Proposed content comes back through a human-controlled workflow before it becomes live Program data.
Current Turnover Programs use defined cloud and data authorities.Depending on Program configuration and feature use, Turnover uses SQL services, Firebase and Firestore services, Firebase Storage, Realtime Database, Turnover Login, and Turnover-controlled PHP service endpoints. Exact data paths vary by feature and deployment…Technical explanation
Architecture
Current Turnover Programs use defined cloud and data authorities.
Depending on Program configuration and feature use, Turnover uses SQL services, Firebase and Firestore services, Firebase Storage, Realtime Database, Turnover Login, and Turnover-controlled PHP service endpoints. Exact data paths vary by feature and deployment.
Operational and historical authorities
SQL and Firebase-family services serve different operational, configuration, working-state, and durable-history responsibilities inside the product.
Files and supporting content
Configured file, image, profile-photo, and private external-form workflows use controlled storage paths appropriate to the feature. Exact storage requirements can be reviewed for a deployment.
Protected web connections
Turnover is served over HTTPS. Customers should also secure endpoints, browsers, credentials, and local networks used to access the service.
Configuration-specific review matters. Turnover does not promise that every Program uses every listed service in the same way. For procurement or IT review, ask for the data-flow and control details for the deployment being considered.
Customer operational information stays Customer Data.Customer retains ownership of Customer Data. Turnover processes it to provide, secure, support, and improve the service for that Customer and does not expose identifiable Customer operational content to other customers by default.Technical explanation
Customer Data boundaries
Customer operational information stays Customer Data.
Customer retains ownership of Customer Data. Turnover processes it to provide, secure, support, and improve the service for that Customer and does not expose identifiable Customer operational content to other customers by default.
Customer ownership
Operational records, technical content, files, forms, and other Customer-submitted content do not become Turnover intellectual property merely because Turnover stores or processes them.
Shared Knowledge is separate
Turnover Shared Knowledge may be offered as a paid add-on. Cross-customer contribution is off by default and requires separate affirmative administrator opt-in.
Providers have defined roles
Hosting, authentication, database, storage, communications, payment, security, and configured model-processing providers may process information only as needed for their permitted service role.
A customer should know what happens when service ends.Unless a different written agreement applies, the standard self-service policy provides a 30-day post-termination period to retrieve available Customer Data. After that window, active-system deletion may proceed, while protected backup remnants may age out for…Technical explanation
Export, retention, and exit
A customer should know what happens when service ends.
Unless a different written agreement applies, the standard self-service policy provides a 30-day post-termination period to retrieve available Customer Data. After that window, active-system deletion may proceed, while protected backup remnants may age out for up to 90 days or remain longer where law, security, dispute preservation, or a written agreement requires it.
- Normal in-product and feature-specific exports remain subject to permissions and available product controls
- TurnBase mass export is separately controlled and durably audited
- Backups are not intended to function as an ordinary post-termination customer archive
Standard lifecycle
Active serviceAVAILABLE
Authorized users work with Customer Data under the configured Program permissions.
30-day retrieval windowRETRIEVE
Available Customer Data can be retrieved or requested after termination unless a different agreement applies.
Active deletion + backup agingLIFECYCLE
Active-system deletion follows the retrieval window. Protected backup remnants may persist temporarily under the published policy.
Turnover supports industrial work. It does not replace safety systems or qualified judgment.Turnover can help document safety concerns, controlled forms, approvals, work history, and related information. It is not an emergency dispatch system, machine-control system, protective device, or safety instrumented system.Technical explanation
Industrial boundary
Turnover supports industrial work. It does not replace safety systems or qualified judgment.
Turnover can help document safety concerns, controlled forms, approvals, work history, and related information. It is not an emergency dispatch system, machine-control system, protective device, or safety instrumented system.
Keep required systems independent
Do not use a Turnover notification, form, or AI response as a substitute for required life-safety, machine-safety, emergency, or protective systems.
Company procedures still control
Customers remain responsible for their procedures, permits, regulatory duties, training, approvals, and safe operation of facilities and equipment.
Human review still matters
AI-assisted explanations, form drafts, and proposed structured data should be reviewed by qualified people before they are relied on for safety, engineering, quality, or compliance decisions.
Security still depends on customer choices.Customers should protect credentials, use unique accounts, remove access when roles change, review administrator assignments, secure endpoints, and decide what information is appropriate for their configured Program.Technical explanation
Shared responsibility
Security still depends on customer choices.
Customers should protect credentials, use unique accounts, remove access when roles change, review administrator assignments, secure endpoints, and decide what information is appropriate for their configured Program.
No absolute-security or certification claim. No internet-connected software can guarantee absolute security. Turnover has not represented SOC 2, ISO 27001, or another certification unless Turnover expressly provides current evidence of that certification. Configuration-specific logging, backup, retention, model-processing, integration, data-processing, and compliance requirements should be reviewed before deployment.
Trust review
Need to review Turnover with IT, security, legal, or procurement?
Ask for the real architecture, permissions, AI boundary, retention, and data-flow answers for the Program you are considering. Security concerns can also be reported to contactus@turnoverllc.com.