Security and trust
Protecting customer data is part of the service.
Jylus applies layered controls across identity, tenant access, transport, service operation, and disclosure response.
Identity and access
Scoped API keys, server-side sessions, email verification, passkeys, and multi-factor authentication protect account and administrative access.
Application controls
Same-origin mutation checks, CSRF validation, strict input schemas, rate limits, no-store handling, and restrictive browser security headers reduce common web attack paths.
Data protection
Tenant-scoped credentials and queries, encrypted transport, controlled service identities, and auditable account actions support workspace isolation.
Operational response
Jylus monitors service health, records security-relevant events, and maintains private channels for vulnerability and incident reporting.
Workspace isolation
The server derives the data-plane tenant from the authenticated workspace key. A namespace is searchable metadata, not a credential or a way to select another workspace. Production and test keys have separate data-plane scopes. Read and write permissions are enforced independently.
Hosting and transport
The public service uses OVHcloud infrastructure with a Sydney, Australia data region. Public HTTPS traffic is encrypted in transit. Account and service metadata uses MongoDB Atlas. See the subprocessor list for service roles; request workload-specific location and encryption-at-rest details before sending regulated data.
Retention and deletion
Searchable history follows the workspace's plan and retention window. Anonymous Try runs use isolated single-use tenants, block further access after completion and queue deletion; the returned lifecycle state describes progress. For production deletion requests and backup treatment, contact support for the applicable terms.
Model use and source proof
Native evidence compilation does not call an answer model. Proof IDs let an authorised client trace selected evidence back to its own records. Jylus does not use Customer Data to train general-purpose AI models without express agreement.
Enterprise diligence
Request a security questionnaire, production-access policy, backup controls, recovery objectives, incident-notification commitments and penetration-test information at security@jylus.ai. These requirements should be confirmed in writing for your deployment.
Assurance and agreements
This page does not claim SOC 2 or ISO 27001 certification. No certification, recovery SLA or independent assessment is implied by a benchmark result. Data-processing agreements and service commitments are agreed separately for the relevant workload.
Coordinated disclosure
Report a security issue privately.
Email security@jylus.ai with the affected endpoint, reproduction steps, impact, and a safe contact method. Do not include customer data, credentials, or secrets.
Jylus will acknowledge reports, assess severity and scope, coordinate remediation, and communicate material findings as appropriate. This policy does not authorise access to another customer workspace, denial-of-service testing, social engineering, or destructive testing.