Overview
Turbo360 is built to meet the information security and compliance requirements of enterprise customers. This article describes Turbo360's infrastructure design, authentication options, data protection practices, and operational standards, providing the technical detail your IT and security teams need to evaluate and approve the platform.
Business value
Understanding Turbo360's compliance posture reduces the time spent on security reviews and vendor assessments. Customers gain visibility into how their Azure cost and monitoring data is stored, encrypted, and isolated, enabling faster procurement decisions and ongoing governance assurance.
How it works
Turbo360's architecture separates all business logic into a REST API layer. The client user interface (UI) is built entirely on top of the API and contains no business logic. This separation limits the attack surface and simplifies security review. Turbo360 is available in two deployment models:
- SaaS: hosted and managed by Kovai on Microsoft Azure in the West Europe region. Security, scaling, maintenance, and threat mitigation are handled by Kovai's in-house engineering teams operating across UK and India.
- Private Hosting: deployed into the customer's own Azure environment. The customer controls the infrastructure, and Kovai provides the deployment artefacts and upgrade procedures.
Infrastructure
The Turbo360 SaaS infrastructure is built on the following design principles:
- The UI is built using Angular and relies entirely on the API for all operations.
- Customer data is stored in Azure SQL elastic pool. Each customer has a separate, isolated database — no shared-schema multi-tenancy.
- The database tier is not accessible from the public internet. It operates within a private subnet on Microsoft Azure.
- All data is encrypted in transit for both the API and the UI. TLS 1.2 and 1.3 are supported.
- Infrastructure is auto-scaled based on CPU usage and processor load.
Authentication
Turbo360 supports two authentication modes. The mode is selected at the time of sign-up and can be changed later:
- Basic: email address and password authentication.
- Microsoft Entra ID: SSO via Microsoft Entra ID. Available to all customers using the SaaS model and required for Private Hosting customers who want a single sign-on experience.
Infrastructure monitoring
Turbo360 uses its own platform for real-time alerts and monitoring of the SaaS infrastructure. App services and cloud services are auto-scaled based on load.
Support and billing
- Support tickets can be raised by email or from within the Turbo360 platform. Tickets are triaged and assigned to second- or third-level support engineers based on complexity and severity.
- Billing is managed through Chargebee. Credit card processing is handled by Stripe, which is PCI DSS Level 1 Compliant. Kovai does not store any billing or card information on its own systems.
- Support is available via phone or web call, and live chat within the platform.
Release management
- Source control and branching are managed using Azure DevOps. Feature branches are used to ensure clean code merges.
- All code changes go through a strict CI/CD pipeline and QA process on a staging environment before promotion to production.
- Application exceptions and runtime issues are automatically captured and stored in Azure Table Storage.
Supported browsers
Turbo360 supports modern browsers using TLS 1.2 or TLS 1.3.
| Browser | Minimum version |
|---|---|
| Internet Explorer | IE7 on Windows Vista |
| Google Chrome | Latest version on Windows Vista or OS X 10.5.7 |
| Mozilla Firefox | 2.0 |
| Opera | 8.0 (with TLS 1.1 enabled) |
AI features and third-party data processing
Turbo360 includes AI-powered features across its modules, including AI Agents in Cost Analyzer and Business Applications, and Explain with AI on recommendations and monitoring widgets. These features send a subset of your Azure resource data to Azure OpenAI to generate responses.
What is sent to Azure OpenAI
When an AI feature is invoked, Turbo360 assembles a prompt from your resource's current data and sends it to Azure OpenAI. The data included varies by feature but covers categories such as resource metadata, cost and usage data, resource configuration data, Azure Monitor metrics, and monitoring configuration. Azure resource tags may also be included where relevant to the agent's analysis.
Your Azure service principal credentials are never included in the data sent to Azure OpenAI. Responses are streamed directly to the user's browser and are not stored or logged by Turbo360, with one exception: Automatic anomaly detection in Cost Analyzer stores a structured AI verdict (result, confidence, and severity) as part of the alert object to drive notification routing. The full response text is not stored.
For the complete data transparency statement covering each AI feature, see AI Agents in Cost Analyzer and AI Agents in Business Applications.
SaaS and Private Hosting
- SaaS: resource data is sent to a Turbo360-managed Azure OpenAI connection. Turbo360 manages this connection on your behalf.
- Private Hosting: resource data is sent to the Azure OpenAI resource you configure under Settings. The data stays within the connection you own and control. AI features are not available until an Azure OpenAI resource is connected.
AI-generated content
All outputs from AI Agents and Explain with AI features are generated by Azure OpenAI and should be reviewed before acting on them. They reflect your resource data at the time of the request and are not deterministic system outputs.
Certifications and compliance
Turbo360 maintains the following certifications:
- GDPR: Turbo360's privacy practices are aligned with EU GDPR requirements. See the Turbo360 Privacy Policy for full details.
- SOC 2: Turbo360 holds a SOC 2 certification. See the SOC 2 compliance page for details.
- ISO 27001: Turbo360 is ISO 27001 certified.
Limitations
- The SaaS deployment is hosted exclusively in the Microsoft Azure West Europe region. Customers requiring data residency in other regions should consider the Private Hosting deployment model.
- Basic authentication mode does not support SSO. Customers requiring SSO must use Microsoft Entra ID authentication.
- Database access is restricted to the private subnet. Direct customer access to the database is not supported under the SaaS model.