Trust

Security & Information Protection

Lenders, owners, and brokers send us sensitive financial material. This page states plainly how we handle it.

Last updated September 4, 2026

Certification status. Turn Quick Hospitality Holdings LLC is not currently certified to ISO/IEC 27001. We are building our information security management system against that standard and a certification audit is being scheduled. Until a certificate is issued, nothing on this page should be read as a certification, attestation, or audit outcome.

The practices below describe the controls in place today for this website and the internal dashboard behind it. They are owner-authored statements, not third-party findings.

Access control

Administrative access requires an individually provisioned account. There is no public sign-up for the internal dashboard, and permissions are granted per person by role. Roles are stored separately from user profiles and enforced by the database on every request.

Data segregation

Every table enforces row-level authorization in the database itself, so a request can only reach records the requester is entitled to see. Authorization is not left to the browser.

Encryption in transit and at rest

The site is served exclusively over HTTPS. Database contents and uploaded files are stored encrypted at rest by our hosting providers.

Document handling

Uploaded financial documents live in a private storage area that is never publicly listable. Links sent by email carry an opaque token, expire after seven days, and are exchanged server-side for a download link valid for sixty seconds.

Least-privilege secrets

Privileged service credentials exist only on the server side, are never shipped to the browser, and are not printed in logs or emails.

Logging and monitoring

Application errors, authentication events, and document access are logged with timestamps so unusual activity can be reviewed.

Retention and deletion

Submissions are kept only for as long as a relationship is active plus a defined recordkeeping period, and can be deleted earlier on request.

Change management

Site and schema changes are version-controlled and reviewed before release, and database changes are applied as recorded migrations.

Vendor review

Third-party providers that process submitted information are listed publicly on our subprocessors page and reviewed before use.

Incident response

Suspected incidents are triaged by the co-founders, affected parties are contacted directly, and remediation steps are documented.

Report a vulnerability

If you believe you have found a security weakness in this website, email admin@turnquickhospitality.xyz with the subject line “Security report” and enough detail to reproduce it. We ask that you give us a reasonable opportunity to remediate before disclosing publicly, that you do not access or modify data belonging to others, and that you avoid testing that degrades service. We will acknowledge receipt and tell you what we did.

What we ask of you

Send only what an evaluation requires. Do not include Social Security numbers, government identification numbers, banking credentials, or payment card data.
Confirm you are authorized to share any third-party or borrower information.
Use the upload fields rather than email for financial documents where possible.
Keep your account credentials private and tell us immediately if they are lost.

Document links in email

Documents we send are never attached as public links. Each link carries an opaque token, expires after seven days, and is exchanged on our server for a download valid for sixty seconds. Access is logged.