Trust

Data residency

The honest version: your data lives in managed Postgres (Supabase) behind a serverless app layer (Vercel). The region is a property of your deployment, not a certified global guarantee — and for Teams we're happy to discuss pinning it.

Where your data lives

Jettova's primary data store is Supabase, a managed Postgres platform. Application hosting and delivery run on Vercel. Together these hold your account data, saved trips, org membership, and the structured expense fields you create — the data described on our Security page.

We aim to keep the moving parts few and legible: managed Postgres for durable data, a serverless application layer in front of it, and the named sub-processors listed at /subprocessors for specific functions like email, push, and AI planning.

Region

The specific geographic region in which data is stored and processed is as configured for your deployment on our infrastructure providers. Rather than assert a single certified region here, we describe it accurately: the region is a property of the Supabase project and Vercel configuration serving your account, and some sub-processors may process limited data in other regions to perform their function (for example, AI planning or email delivery).

We don't claim a data-residency guarantee we can't back. If your organization has a specific residency requirement, treat the region as something to confirm with us for your deployment rather than something asserted globally on this page.

In transit and at rest

Data is encrypted in transit everywhere using HTTPS/TLS, and managed Postgres storage is encrypted at rest by our infrastructure provider. Per-request geo signals used to localize suggestions are computed from the connecting request and are not stored.

Region-pinned hosting for Teams

For Teams customers with regional data requirements, region-pinned hosting and processing can be discussed as part of a Teams agreement. Because the region is a deployment property rather than a fixed global setting, we prefer to scope it to your actual requirement instead of over-promising in a public page. Contact us to talk through what your organization needs.

Related: Security, Sub-processors, and the Data Processing Addendum.

Have a regional requirement? Talk to us.