Security at Jettova

Data protection

Your data lives in Supabase Postgres. The database denies direct access by default — row-level security is deny-all, so nothing is readable or writable straight from a client. Every read and write goes through our own server routes, which authenticate the caller first and then use a scoped service-role credential to touch the database. The service-role key never leaves the server.

Traffic is encrypted in transit everywhere: HTTPS with strict transport security between your browser or app and our servers, and between our servers and the databases and APIs we call. Managed Postgres storage is encrypted at rest by our infrastructure provider.

Authentication

Sign-in runs on Supabase Auth. Individuals can use magic-link email or OAuth with Apple and Google. For Teams, we support enterprise SSO over SAML through Supabase: your identity provider (Okta, Azure AD / Entra, Google Workspace) is registered with Supabase, and we map your email domain to it so members sign in with your company IdP.

For Teams that want automated provisioning, we expose a SCIM 2.0 endpoint (Users and Groups) scaffolded per organization. SCIM tokens are shown once at creation and stored only as a SHA-256 hash — we never keep or display the plaintext. SAML SSO and SCIM are configured per Teams customer; when they aren't set up, sign-in degrades gracefully to email and OAuth.

Access control

Teams accounts use org-scoped role-based access control. Every member holds a role — owner, admin, or member — and each org-console action is checked against the required role before it runs. Owners manage owners; admins manage members and billing; members have read-scoped access. Cross-org isolation is enforced server-side, so one org's admin can never reach another org's members or data.

Sensitive org actions (role changes, member removals) are written to a per-org audit log so an owner or admin can review who did what, and when, for their own team.

Monitoring

Application errors are captured with Sentry so we can detect and diagnose problems quickly. We keep instrumentation to what we need to operate the service reliably; our product analytics are first-party rather than handed to ad networks.

Payments

Jettova does not store card data. Consumer and Teams billing runs through Stripe: card entry, processing, and storage happen on Stripe's side. We hold only the non-sensitive references Stripe returns (customer and subscription identifiers) needed to manage a subscription. Travel bookings surfaced in the product are completed on the booking partner's own checkout, so those card details never touch us either.

API security

The public API authenticates with per-key bearer tokens. We store only a SHA-256 hash of each key, never the key itself, and look up requests by that hash. Every key-gated call runs the same path: environment gate, key-format check, hashed lookup, and an atomic monthly usage meter that enforces the plan's quota (with optional idempotency for billable calls).

Requests are rate-limited with Upstash Redis using a sliding-window limiter, keyed by API key or by IP for anonymous traffic, to contain abuse and protect capacity.

Data lifecycle

We keep what's needed to plan and save trips, and we deliberately drop what we don't need. When you scan a receipt for expense splitting, the image is processed by our AI vision step and then discarded — only the structured fields (merchant, total, currency, line items) are kept, never the image bytes.

Leaving is self-serve. You can delete your account and its data yourself, anytime, at /delete-account. Teams owners and admins can export their organization's data through the org console. Deletions are hard deletes of the underlying rows, not soft flags.

Certifications & roadmap

We want to be straight with you about where we are. Jettova is not currently SOC 2 certified. A SOC 2 Type II examination is on our roadmap, not yet completed — we won't claim it until an auditor has. We likewise do not currently hold ISO 27001 or PCI DSS certification; card handling is delegated to Stripe, which is itself PCI-compliant.

What is true today: we operate GDPR-aligned practices — data minimization, self-serve deletion and org export, first-party analytics, and processing through named sub-processors under contract. If your procurement needs specific attestations, contact us and we'll tell you honestly what we can and can't provide right now.