Overview
OpenDesk is an agency desk built by TurnNet Labs LLC to help insurance teams manage clients and quoting workflows.
We take a practical approach to security: unique accounts, encryption in transit and at rest via our cloud providers, MFA with authenticator apps (TOTP) on privileged access and before PII leaves the desk via rater bridges, and clear limits on what data is shared.
SOC 2: Our SOC 2 program is in progress / targeting Type I then Type II. We are not SOC 2 certified at this time. We will update this page when an independent report is available.
Security contact: turnnetprotocol@proton.me
Owner: Cameron, TurnNet Labs LLC
Encryption
- In transit: All OpenDesk web traffic uses HTTPS / TLS (via Vercel).
- At rest: Customer data is stored with Supabase and Vercel using their encryption-at-rest controls (AES-256 class).
- Payments: Card payments are processed by Stripe. OpenDesk does not store full payment card numbers (PAN).
Access
- Users authenticate with unique accounts. Shared passwords for an agency seat are not allowed.
- Privileged paths and rater-bridge exports use multi-factor authentication via TOTP (authenticator app).
- Labs Desk requires 2FA and 2-hour sessions. OpenDesk strongly recommends two-step for all owners; it is required before Canopy / Zapier / rater file export.
- Agencies control their own seats and should remove access promptly when staff leave.
Subprocessors
- Vercel (United States) — application hosting and APIs
- Supabase — database and related storage
- Stripe — billing / payments
- Resend — transactional email
- HealthSherpa — health / Medicare partner features when used
- Tremendous (optional) — gift / rewards when enabled
- Canopy / Zapier — only when an agency configures outbound rater bridges (not on by default)
Questions: turnnetprotocol@proton.me
Incident response
If we confirm a security incident that affects Customer Data, we aim to notify affected agency customers within 72 hours, with known facts, containment status, and recommended next steps. Report suspected issues to turnnetprotocol@proton.me.
No scraping
OpenDesk does not scrape TurboRater, EZLynx, carrier portals, or other rating systems. Agents enter premiums they obtain through legitimate workflows. Optional rater bridges (Canopy, Zapier, CSV/clipboard) send allowlisted applicant fields only and never send Social Security numbers or full card numbers. Official Vertafore / TurboRater API access is pursued through the Orange Partner program.
Related
Contact
TurnNet Labs LLC
Security / privacy: turnnetprotocol@proton.me
Product: opendesk-nine.vercel.app