Trust

Security and privacy overview

Clients trust us with their business processes and data. This is a plain account of how the platform protects them today.

Hosting and infrastructure

The platform runs on Vercel, behind Cloudflare, with the database on Neon (PostgreSQL) in the United States.
All traffic uses HTTPS. HTTP requests are redirected, and browsers are told to use HTTPS only (HSTS).
Pages send strict security headers: a content security policy, no framing by other sites, and no content-type guessing.

Sign in and access control

Staff and clients sign in on separate screens, and each account can only use its own side of the platform.
Clients can only ever see their own projects. Every request checks ownership on the server.
Passwords are stored only as salted bcrypt hashes. We cannot read them.
Sign-in, registration and password reset are rate limited per account and per network address.
Sessions expire after 8 hours. A password reset or change ends every existing sign-in on every device, and staff can sign out everywhere at any time.
Password reset links are single-use, expire after one hour, and are stored only as hashes.

How we handle your data

We collect only what a form asks for. We do not sell personal data or use advertising or analytics trackers.
Contracts uploaded for progress tracking are read once: only the scope-of-work text is kept, and the file itself is discarded.
Job applicants’ resumes are stored privately. They are never public, and only staff can download them.
Uploaded files are checked for size, type and actual content before they are accepted.
Full details are in our privacy policy, including your rights in South Africa, the EU and UK, the United States, Africa and Asia-Pacific.

Use of AI

For client projects, the agreed scope of work and information about the project’s code are sent to Anthropic’s AI service to write plain-language progress summaries.
Client reviews are sent to the same service to check them for offensive or private content and to translate them. Reviews are never held back for being negative.
Jall AI, the website and portal assistant, uses the same service. In the portal it can only see the signed-in client’s own projects, and it cannot change records, prices or deadlines.
Website text and reviews are translated into other languages with Google Cloud Translation, and translated reviews are labelled as such.
AI output is informational. It never makes decisions about people, and progress figures in the portal are estimates, not contractual commitments.

Protecting the platform itself

When the platform reads a website on our behalf, it refuses private and internal network addresses, checked at the moment of connecting, and limits how much it downloads.
Every public form and API has a size limit, and requests are validated on the server.
Code changes are covered by automated linting, type checking, unit tests and browser tests.

Backups and recovery

Our database provider keeps a history that lets us restore the database to an earlier point in time.
Releases can be rolled back to the previous version within minutes.
Database changes are written so the previous release keeps working while a new one is deployed.

Reporting a security issue

If you believe you have found a vulnerability, email [email protected] with “Security report” in the subject. Please give us a reasonable chance to fix it before telling anyone else. For how we handle personal data, see our privacy policy.

Have a security questionnaire?

Send it over. We’ll answer it accurately, including where something is not in place yet.