Capabilities statement

Turbo Client Systems (TCS) builds zero-trust, zero-knowledge, Azure-native tools for commercial companies, federal contractors, and federal agencies. The tools sign people in with Microsoft Entra ID and keep customer data in the customer’s own Microsoft 365 tenant. Four people run 31 active repositories across four GitHub organizations split by circle of trust (the tools we sell, the shared services, the marketing sites, and the games), one Entra tenant, and one continuous-integration standard.

What we hold about a customer is billing: who pays us for which tools, and nothing beyond what Stripe, our payment processor, holds. The tools run no analytics. We hold what a person chooses to send us (a bug report, a message or booking through a site, or written consent to be named in a case study) and nothing else about their use of a tool.

AI coding agents write nearly all of our code, under rules written by people and checks enforced by machines. A change that passes every required check merges and deploys itself.

TCS is pre-revenue and pre-contract. The known-limits section below states what is not in place yet.

One platform repository publishes 45 versioned packages and the shared CI workflow, and every site and tool consumes both. The packages are ES modules with type declarations, published privately to GitHub Packages with Changesets, and consumed as ordinary dependencies, so a fix ships once and every application picks it up through Dependabot.

Identity. Sign-in runs in the browser with Microsoft’s MSAL library. By default the token is kept in that tab’s session storage; a person can choose to stay signed in across tabs. A rare admin-only action, such as provisioning a SharePoint site, uses a second sign-in held only in memory, with a warning banner on screen while it is live, and discards it afterward. Microsoft endpoints for the commercial, GCC High, and DoD clouds are a typed table in one package, and an unknown cloud fails the build.

Configuration storage in the customer’s tenant. The Portal provisions one SharePoint site per customer tenant, the workspace map, holding these lists: Tenant, Products, ProductSettings, Groups, GroupRoles, GroupRoleHistory, ProductInstalls, ManagedTenants, and UserPreferences. Each product serves a JSON manifest at a well-known path declaring the lists, fields, roles, and settings it needs, and reaches its own site through the Sites.Selected Graph permission. A product decides what a person may do from their Entra group membership.

Application shell. Each Next.js application applies a shared configuration that sets Content Security Policy, HSTS with preload, X-Frame-Options, nosniff, a strict referrer policy, and a Permissions-Policy, and mounts Vercel BotID for public endpoints. The consent package gates storage, statistics, and marketing behind a choice the visitor can refuse, a lint rule forbids vendor endpoints written outside the package that owns the vendor, and an opt-in rule forbids tracking that bypasses consent. The UI package is themed through 20 semantic colour roles with light, dark, and high-contrast settings. Our sites send mail through Microsoft Graph with no stored credential, and the payments package refuses Stripe live mode unless it is switched on explicitly.

Hosting. Vercel, one project per repository, deployed only from GitHub Actions; Vercel’s own Git integration is off.

Workload identity. Our sites send mail with no stored credential: each production deployment exchanges a Vercel OIDC token for a Microsoft Graph token as its own Entra app registration, and Mail.Send is granted only through Exchange scoping to that site’s own mailbox. GitHub Actions uses a token minted for each run.

Keys that remain. Some keys still exist. The reviewed key list places eight in GitHub’s organization secret store for CI: two for the deploy and the CI app, and six test-account credentials shared only with the repositories that run browser tests. Applications read four at runtime from sensitive Vercel variables. The list holds names only, never values, and the stores themselves were not re-read for this page. Keys are rotated by hand on a calendar until rotation is automated.

Customer data. Governance keeps answers and evidence in a SharePoint site inside the customer’s tenant, reached with the signed-in person’s own delegated token. Lint rules forbid server actions and any route that reads a request body.

Pipeline and application controls. Gitleaks scans every change for credentials and actionlint checks the workflows themselves. `any` is banned. Every web application ships the same security headers from one shared configuration, and public endpoints carry bot verification.

Already in Microsoft. Identity (Entra ID), authorization (Entra groups), customer data and our own configuration model (SharePoint in the customer’s tenant), and site mail (Exchange Online). The Microsoft endpoint package already carries typed tables for the commercial, GCC High, and DoD clouds. We have not deployed to GCC High or DoD, and would prove it in a test tenant before relying on it.

Outside Microsoft today. Hosting is on Vercel (with Vercel BotID, Vercel Web Analytics, which measures a visit only after the visitor consents, and Vercel Blob storage for the Turbo Bid System’s feed). Source, CI, and packages are on GitHub, and CI runs on self-hosted runners on our own machines. Moving to Azure means replacing these.

• Customer data stays in the customer’s tenant. Governance keeps answers and evidence in the customer’s own Microsoft 365 tenant, reached with the signed-in person’s delegated token, and lint rules forbid the server code paths that would let it receive them.
• One platform, one standard. Identity, consent, security headers, forms, mail, theming, translation, testing presets, and lint rules are versioned packages that every application consumes. A fix ships once and reaches every application through Dependabot.
• Compliance content is our product domain. We maintain a linked graph of statutes, standards, mandates, roles, workflows, and exams, including CMMC Level 2, DFARS CUI protection, NIST CSF 2.0, FISMA, ISO/IEC 27001, HIPAA, HITECH, SOX 404, and CCPA.
• Agent-assisted engineering that a prime can audit. AI coding agents write nearly all of our code under human-authored rules, through the same checks as anyone else. Every rule, decision, and trade-off is in a versioned file or an issue thread.

How we work with a prime. Everything we build is TypeScript on Next.js with Microsoft Entra sign-in, so a prime’s own engineers can maintain it.