Security

Jasify is designed to help users store business knowledge, build AI workflows, run AI workers, and use Marketplace integrations. We take security seriously and use technical, organizational, and infrastructure safeguards to help protect user data.

No online service can be guaranteed to be perfectly secure, but Jasify is built with security controls across authentication, database access, storage, payments, connected accounts, and AI workflow execution.

Jasify supports:

• Email and password sign-in
• Google OAuth sign-in

Passwords are handled by Supabase Auth. Jasify does not store or see plaintext passwords.

Jasify uses row-level security on public database tables to help ensure users can only access data they are authorized to access.

User roles are managed through a dedicated role system. Admin checks are handled through security-definer functions.

Jasify also uses views to hide sensitive vendor and worker fields from public access, such as private webhook URLs and payout information.

Jasify uses Lovable Cloud / Supabase for:

• Postgres database
• Authentication
• Storage
• Edge functions

User content may include Company Brain documents, workflow data, generated outputs, AI worker configurations, and marketplace activity.

Jasify uses AI providers through Lovable AI Gateway.

Relevant workflow inputs, prompts, retrieved Company Brain context, uploaded files, and workflow outputs may be sent to AI providers such as OpenAI or Google Gemini to generate requested outputs.

Jasify does not use customer content to train Jasify-owned AI models.

OAuth tokens for services such as Google, HubSpot, and LinkedIn-related connectors are stored server-side and are not exposed directly to the browser.

Users can disconnect supported providers when they no longer want Jasify to access those accounts.

Jasify uses Stripe for payment processing.

Jasify does not store full card numbers or CVV codes. Payment details are handled by Stripe.

Some Marketplace workers may be powered by third-party vendors or external APIs.

When a user chooses to run a vendor-powered worker, relevant workflow inputs may be sent to that vendor's system so the worker can complete the requested task.

Jasify may review, approve, suspend, or remove Marketplace listings that create risk, violate policies, or misuse the platform.

Jasify enforces file-size limits for certain uploads and AI processing. Current binary processing limits include a 5 MB cap per file.

This helps reduce abuse, cost spikes, and denial-of-service risk.

Jasify maintains email suppression and unsubscribe systems for bounces, complaints, and marketing opt-outs.

Transactional emails such as receipts, account notices, run alerts, and security notices may still be sent where necessary.

Jasify is an early-stage product. The following are not currently claimed unless later confirmed:

• No published SOC 2 report
• No published ISO 27001 certification
• No public third-party penetration test report
• No formal incident-response SLA
• No self-serve data export endpoint yet
• MFA/2FA status is still to be confirmed
• HIBP password check status is still to be confirmed

We will update this page as our security program matures.

If you believe you found a security issue, please contact us at security@jasify.com.

Please include:

• A description of the issue
• Steps to reproduce it
• Affected pages or systems
• Any relevant screenshots or logs
• Your contact information

Do not access, modify, delete, or exfiltrate data that does not belong to you.