Security & data residency
The safest place for your content is your own network
A search SaaS asks you to trust its compliance badges with your content and your users' queries. Viglet Turing ES is self-hosted: the data never leaves your infrastructure to begin with — so security inherits the controls you already run. Open source, any LLM, your region, your rules.
Don't trust a vendor's boundary — remove it
SOC 2 and GDPR paperwork exist because a hosted vendor holds your data. When you self-host, that boundary disappears: your content, embeddings and query logs stay inside the account, region and controls you already operate — nothing to transfer, nothing to audit on someone else's word.
How Turing keeps you in control
Concrete, defensible guarantees — not compliance theater.
Your data never leaves your network
Turing is self-hosted. Indexed content, embeddings and query logs live on your own infrastructure — there is no SaaS tier collecting them and no telemetry phoning home.
Data residency by construction
Because you run it, your data stays in whatever region and account you already control — no data-processing addendum to negotiate, no cross-border transfer to reason about.
SSO & encrypted secrets
Put the admin console behind your identity provider over OIDC single sign-on (Keycloak-based). Provider API keys and credentials are stored encrypted at rest.
Keep even the LLM in-house
Run fully local models (Ollama) or an OpenAI-compatible endpoint inside your network, so prompts and content never reach a third-party model provider.
Auditable, open source
Every line is Apache 2.0 — your security team can read exactly what it does, pin a version and build it themselves. No black box to take on faith.
Small attack surface
CSRF protection, a read-only public search/chat surface with every write and admin endpoint behind authentication, and sandboxed (Docker) code execution and skills.
What self-hosting means for your compliance
Turing is software you run, not a service we operate — so it has no SOC 2 report of its own to hand you, and it doesn't need one. Deployed inside your environment, it runs under the certifications, network controls, logging and data-residency guarantees your infrastructure already carries. You keep the audit trail; we keep the source open so your team can verify every claim on this page.
- Self-hosted under Apache 2.0
- Content, embeddings & query logs stay on-prem
- Bring your own LLM — or run fully local
- No telemetry, no phone-home