Trust
Security at JagaSec
Last updated: 22 June 2026
Security isn't a feature we bolt on, it's how every product begins. Here's a high-level look at how we protect your data.
Our approach
We design with threat modelling and least-privilege from day one. We keep this page intentionally high-level, enough to earn your trust, without publishing a map for attackers.
Data protection
- Encryption in transit, all traffic to the Service is served over modern TLS.
- Encryption at rest, full-disk encryption of stored data is on our near-term security roadmap.
- Secrets handling, credentials are stored using strong, industry-standard one-way hashing, never in plain text.
Access control
Access is role-based and enforced on the server for every request. Internal access to production follows least-privilege and is limited to what is necessary to operate the Service.
Tenant isolation
Every organization's data is logically isolated from every other organization, enforced in depth so that one customer can never see another's data.
Monitoring & audit
Security-relevant application events are recorded in tamper-evident activity and security audit records. Customer-facing automated incident monitoring is not yet published as an implemented control.
Resilience & backups
Production backup ownership, off-site retention, restore verification, and alert routing are under operational review. Verified recovery commitments will be published when evidence is complete. See the Status page for the latest manual service check.
Responsible disclosure
Found a vulnerability? We welcome reports from the security community. Please email [email protected] with details and steps to reproduce. Act in good faith, avoid privacy violations and service disruption, and give us reasonable time to fix the issue before any public disclosure. We will not pursue researchers who follow these guidelines.