Trust

Security, compliance and AI governance

What is implemented today, what is committed at first production tenant, and what is not in place yet. Stated as facts so a procurement review can be answered from this page rather than from an email thread.

Current status

Service stage	Pre-launch. The marketing site is in production; the authenticated platform is in development and holds no client data.
Production tenants	None yet. No client data has been processed on this platform.
What this page describes	The controls implemented today, the controls designed but not yet built, and the commitments that apply at first production tenant. Every row that is not in operation today says which of the other two it is.
Independent assurance	None held. No SOC 2, no ISO 27001, no completed penetration test, and no audit has commenced.

Maintained in docs/deployment.md

Authorisation and tenant isolation

Isolation model	PostgreSQL Row Level Security. Every table has RLS enabled and a deny-by-default policy; access is added per audience, never assumed.
Tenant key	Every tenant row carries org_id, derived from its parent by a database trigger and frozen by a trigger after insert, so a caller can neither supply nor change it. The trigger functions exist and are tested; no table attaches them yet.Designed, not yet operating
Client-side checks	Not used for authorisation. A role value in the interface controls what is displayed, never what is readable.
How isolation is verified	Every table has behavioural policy tests run against a real database, including a read by a member of another organisation, which must return zero rows. A pre-push check refuses a table that has no policy test. No server-side pipeline runs these tests today.
Retrieval isolation	Vector search runs through a SECURITY INVOKER function, so row-level policies apply to retrieval itself and not only to the tables behind it. No retrieval exists yet.Designed, not yet operating

Maintained in docs/rls.md

Encryption and access

In transit	TLS 1.3, HSTS enabled, HTTP redirected to HTTPS.
At rest	AES-256, provided by Supabase at the storage and database layer.
Database roles	Routine server and Edge code connects as a least-privilege role (job_worker or ledger_writer), and service_role is break-glass only. Neither role has been created yet.Designed, not yet operating
Secrets	Held in the platform secret store, never in the repository. The JWT signing secret and database password are in no environment file. No automated scan for leaked credentials runs today.
Administrative access	Named accounts only, and every privileged action writes an append-only audit row at the database, so a new code path cannot bypass the trail. The append-only audit table exists; nothing writes to it yet.Designed, not yet operating

Maintained in docs/security.md

Subprocessors and data residency

Published list	Every provider touching personal data, with purpose, data categories, region and DPA status. The list is maintained in the compliance documentation and is not yet published on this site.Designed, not yet operating
Change notice	The list is versioned and clients are notified before a new subprocessor is added.Commitment, not a control in operation
Primary data region	Fixed per project at creation and recorded in the contract. Data residency is a contractual claim, and an unrecorded one cannot be honoured.Commitment, not a control in operation
Model providers	Requests may be processed outside the primary region. Where that is unacceptable for a workload, its model routing is restricted in configuration, not by policy statement. No model is called today.Designed, not yet operating

Maintained in docs/compliance.md

AI governance

Training on client data	Not permitted. Enforced as a provider setting, recorded with the setting name and re-verified quarterly. A provider that cannot offer zero retention does not receive client data.Commitment, not a control in operation
Labelling	Every AI-authored external message is labelled as AI in the interface and recorded in the audit log with model, prompt version and cost. No AI-authored message is sent today.Designed, not yet operating
Commitments	No agent can commit to a price, scope or date. The constraint is structural — agents are given no write path for them — rather than an instruction in a prompt. No agent is deployed today.Designed, not yet operating
Human oversight	Required wherever an output reaches a client or a record. Generated content remains a draft until a named person accepts it, and the acceptance is logged.Commitment, not a control in operation
Sensitive data	Personal data flagged sensitive is redacted before any third-party model call. The redaction function is not built yet, and no model call is made.Designed, not yet operating
Generated media	Labelled as generated wherever it appears. Every image in the site's hero carousels is generated and carries a visible label. The copies a browser receives are re-encoded for size, which strips the Content Credentials (C2PA) manifest the original files carry. We do not publish AI-generated imagery depicting real people, clients or events.
Untrusted content	Uploads, inbound messages and scraped pages are treated as data and never enter a system prompt as instructions. The site accepts none of them today.Designed, not yet operating
EU AI Act	Transparency obligations for systems interacting with people are met by the labelling above and by voice self-identification, neither of which is built yet. Higher-risk classifications are not currently assessed as applying; this is re-assessed at each phase gate.Commitment, not a control in operation

Maintained in docs/ai-agents.md

Data protection rights

Regimes	UK and EU GDPR, and India's DPDP Act.Commitment, not a control in operation
Erasure	Pseudonymisation, run from a documented runbook. Financial records carry a legal retention obligation that overrides erasure; the rest of the subject's data is removed. The erasure tooling is not built yet.Designed, not yet operating
Export and portability	Subject data is exportable in a machine-readable format on request. The export tooling the runbook calls for is not built yet.Designed, not yet operating
Consent	Recorded in a consent registry with the basis, the timestamp and the version of what was consented to, so consent is provable rather than asserted. The registry does not exist yet.Designed, not yet operating
DPA	Available on request and signed before any client data is processed.Commitment, not a control in operation

Maintained in docs/compliance.md

Retention schedule

Financial records, invoices, ledger	7 years (legal obligation)Commitment, not a control in operation
Contracts and signature audit trails	Life of contract plus 7 yearsCommitment, not a control in operation
Audit log	7 yearsCommitment, not a control in operation
Call recordings	12 months, then transcript onlyCommitment, not a control in operation
Chat transcripts	24 months from last activityCommitment, not a control in operation
Anonymous sessions and touchpoints	13 monthsCommitment, not a control in operation
Marketing engagement events	24 monthsCommitment, not a control in operation
Application logs	90 daysCommitment, not a control in operation
Backups	Point-in-time recovery 7 days; encrypted cold storage 35 daysCommitment, not a control in operation
Enforcement	A scheduled job with a dry-run mode, not intention. Each stored file carries a retention class and every deletion is logged. The job is not built yet.Designed, not yet operating

Maintained in docs/compliance.md

Incident response

Notification commitment	Affected clients are notified without undue delay and within 72 hours of becoming aware of a personal data breach, per GDPR Article 33 timing.Commitment, not a control in operation
Process	A documented runbook covering detection, containment, assessment, notification and post-incident review.
Post-incident review	Written for every incident, with the corrective action tracked to completion.Commitment, not a control in operation
Status	The runbook exists. It has not yet been run as a drill, nor against a real production incident, because there has not been one.

Maintained in docs/runbooks/incident.md

Availability and recovery

Uptime history	None published. There is no production tenant history to report. Publishing a figure we have not measured would make every other row on this page less credible.
Target at first production tenant	99.9% monthly for the authenticated platform.Commitment, not a control in operation
Backups	Point-in-time recovery for 7 days; nightly logical dump to encrypted cold storage for 35 days. Neither is enabled yet; both are on the checklist before the first production deploy.Designed, not yet operating
Restore testing	Restore drills run quarterly from the documented runbook, which is what makes a backup a recovery. No drill has been run; the first is due before production launch.Designed, not yet operating
Database migrations	Applied by a deployment pipeline only, never from a workstation, and backward compatible with the deployed application. No deployment pipeline exists yet.Designed, not yet operating

Maintained in docs/deployment.md

Accessibility

Target conformance	WCAG 2.1 Level AA.Commitment, not a control in operation
Current status	Not independently audited and no conformance report published. Components are written against the target — keyboard completeness, visible focus, colour never the only signal, named regions — and nothing checks them automatically yet.
Known gaps	No formal audit has been carried out, so gaps found only by assistive-technology testing are unknown rather than absent.
Reporting a barrier	On WhatsApp at +91 98804 43372, the channel on the contact page, triaged as defects rather than requests. The jjtech.club domain receives no email.

Maintained in docs/design-system.md

Something here out of date, or a question this page does not answer? Ask, and the answer becomes a row on this page rather than a reply only you can see.