Service-Disabled Veteran-Owned Small Business
How We Work
A small team with a complete kit: real software, security that stays simple, and none of the overhead you don't need. Here is how we build, and real work that shows it.
What we believe, in practice
Six principles, each one enforced by how the software is built rather than by a policy document
Keyless by default
Our applications hold no secrets. Each workload proves who it is to Microsoft with OpenID Connect federation instead of a stored password or key, so there is nothing to leak, rotate, or forget. Since September 2026 the whole fleet runs with zero application-runtime secrets.
The session lives in your browser
Sign-in is Microsoft Entra ID, handled in the browser. The token lives in that tab and is gone when the tab closes. Admin-level tokens are held in memory for the one action that needs them, then thrown away. There is no server-side session for us to store, leak, or forget to expire.
Your data stays in your tenant
Our compliance product keeps every answer, upload, and attestation in a SharePoint site inside the customer’s own Microsoft 365 tenant, reached with the user’s own permissions. A tenant admin can revoke us at any time. We cannot misuse data we never hold.
Built once, used everywhere
Identity, consent, security headers, forms, mail, theming, translation, testing, and lint rules are 23 versioned packages every application consumes. A fix ships once and reaches every app, with CI proving each landing. It is a complete kit, built for small-team speed.
Green means go
Nothing merges until seven automated checks pass: credential scanning, dependency rules, lint and format, type checking, tests, and a real build. Nobody, including us, has an override. When everything is green, the pipeline merges and deploys on its own.
We run on what we build
This site, our products, and our internal tools all run on the same packages and the same pipeline. We use what we build every day, so we find the rough edges first and fix them upstream, once, for everyone. We keep only the infrastructure that pays for itself.
One change, end to end
A real change, from ticket to production, with the timestamps
Every change we make goes through the same path, whether it is one line or forty thousand. Here is a real one from this website, with the timestamps GitHub recorded.
- The ticket
- Issue #446, “Remove the Fleet Dashboard from this site and link out to analytics.turboclientsystems.com instead.” It states what goes, what stays and why, and what is out of scope, before any code changes.
- The change
- Pull request #447: 233 files, 198 lines added and 41,894 removed. The dashboard had moved to its own application, so this deleted the old copy, including every line of sign-in code. The public site now has nothing behind a login.
- The gate
- All seven required checks passed on the pull request, then ran again in the merge queue against the exact commit that would land, 23:20:18 to 23:23:32 UTC.
- The merge
- Squash-merged by the pipeline at 23:23:12 UTC on 2026-09-09, 2 hours 28 minutes after the pull request opened. The linked issue closed itself two seconds later.
- The deploy
- The post-merge run built and deployed production from 23:23:16 to 23:25:25 UTC. Merge to live took about two minutes.
Nothing is hidden in the trail. The ticket and the pull request were opened together, as one piece of work. The whole trail, from the reasoning to the checks to the deploy log, is in the repository for anyone we give access to.
Where everything lives
The architecture, drawn as who holds what
Most of what makes an application risky is what it keeps: sessions, keys, customer records. We design ours to keep as little as possible, and put each thing that has to exist with the party that already owns it.
Your browser tab
The signed-in person
Holds
- The sign-in token, in that tab only, gone when it closes
- Admin-level tokens, in memory, for one action
- The application code, as delivered
Your Microsoft 365 tenant
Your organization, and your admin
Holds
- Identity and sign-in (Entra ID)
- Who may do what (Entra groups)
- Your data, evidence, and audit log (SharePoint)
Turbo Client Systems
Us
Holds
- The application code
- The packages it is built from
- The rules and the pipeline
Never holds
- Your data
- Your sessions
- Stored passwords or keys
How they connect
- Your browser signs in to your tenant directly, as you.
- Your browser reads and writes your data in your tenant, with your permissions.
- We deliver code to your browser. Your data never passes through us.
One requirement, every framework
A real control from our compliance registry, mapped across frameworks
Our compliance registry links statutes and standards into one graph, so a single real-world control is recognized under every framework that asks for it. Multi-factor authentication is a good example. One question in the registry is linked to all of these:
| Framework | Identifier | Requirement, as the registry names it | Linked |
|---|---|---|---|
| NIST SP 800-171 Rev 3 | 3.5 | Identification and Authentication Requirements | Directly |
| NIST SP 800-53 Rev 5 | IA-2 | Authentication | Directly |
| ISO/IEC 27001:2022 | A.8.5 | Secure authentication | Directly |
| NIST CSF 2.0 | PR.AC | Identity Management, Authentication, and Access Control | Directly |
| HIPAA Security Rule | 164.312(d) | Person or entity authentication | Through ISO A.8.5 |
| NY DFS 23 NYCRR 500 | 500.12 | Multi-Factor Authentication and Access Controls | Through NIST 800-171 and 800-53 |
The question itself. “An admin argues that long-tenured staff and service accounts should be exempt from multi-factor authentication (MFA) because they’re ‘trusted’ and it would slow them down. What’s the strongest response?” The correct answer explains that exempting any account creates a single point of failure. The three wrong answers are the arguments people actually make.
Why it matters. Answer once, and the evidence counts toward each of those requirements. That is the point of a crosswalk. This question is still marked draft in the registry while the content owners review it, and the registry holds NIST 800-171 at family level (3.5), not as individual requirements.
The rules we write for ourselves
The rules we hold ourselves to, and a real decision record
Every repository carries the rules its contributors follow, human or AI agent, as files loaded at the start of every session. The first three rules every agent reads are:
- Never fabricate. No invented numbers, results, or checks reported as passing that were not run.
- Show your work. Every claim states where it came from: the file and line, the command, or the check.
- Flag uncertainty out loud. A confident wrong answer is worse than an honest “I don’t know yet.”
Lean is a decision, and we write it down. We also cut what does not pay for itself. A CI check that confirmed each pull request linked an issue did five seconds of work and billed a full minute per run, well over a thousand minutes across the fleet. We deleted it (Platform-Packages #481), wrote down what enforcement it gave up, and kept the rule as a convention. Every decision like that is recorded the same way: what we did, why, and what it cost.
Prime or partner
How we fit on a contract, including a VA set-aside
We can prime
As an SBA-certified SDVOSB and HUBZone small business, we qualify for VA’s Veterans First Contracting Program, which gives service-disabled veteran-owned businesses first priority on VA set-asides. We own the architecture, the engineering standards, and the delivery pipeline. Where a contract needs more people or more cleared staff, we bring in larger partners, within the limitations on subcontracting that keep a set-aside honest.
We can sub
We can work inside a prime’s GitHub organization and Microsoft Entra tenant, or deliver from ours. We bring our packages, our pipeline, and our rules, so a prime gets a team with a working delivery system on day one, not a set of résumés.
Either way, you get
Repositories you can read end to end, the issue trail behind every change, and TypeScript on Next.js with Microsoft identity, which your own engineers can maintain without us. Team members hold active security clearances.
Want to see it for yourself?
We will walk you through any of these samples live, in the actual repositories.