Security at Jettova

Data protection

Your data lives in Supabase Postgres, with row-level security on every table. Shared data (group-room members and votes, payments, organizations, school trips) grants no access to a client at all: every read and write goes through our own server routes, which authenticate the caller first and then use a scoped service-role credential to touch the database. The service-role key never leaves the server. A signed-in person can reach directly only records they own, such as their saved trips, profile and the personal group rooms they created, plus trips other people have chosen to publish; the database enforces both limits itself. Someone who is not signed in has no direct access at all.

Traffic is encrypted in transit everywhere: HTTPS with strict transport security between your browser or app and our servers, and between our servers and the databases and APIs we call. Managed Postgres storage is encrypted at rest by our infrastructure provider.

Authentication

Sign-in runs on Supabase Auth. Individuals can use magic-link email or OAuth with Apple and Google. Single sign-on (SAML) and SCIM user provisioning are available on request for Teams workspaces; contact us to enable them. Setting up single sign-on means registering your identity provider with us and mapping your email domain to it, so members sign in with their company account.

SCIM provisioning covers users: your directory can add, look up, deactivate and remove the members of your workspace. A SCIM token is shown once when it is issued and stored only as a SHA-256 hash; we never keep or display the plaintext. Until single sign-on or SCIM is set up for your workspace, members sign in with email or OAuth.

Access control

Teams accounts use org-scoped role-based access control. Every member holds a role (owner, admin, or member), and each org-console action is checked against the required role before it runs. Owners manage owners; admins manage members and billing; members have read-scoped access. Cross-org isolation is enforced server-side, so one org's admin can never reach another org's members or data.

Sensitive org actions (role changes, member removals) are written to a per-org audit log so an owner or admin can review who did what, and when, for their own team.

Monitoring

Application errors are captured with Sentry so we can detect and diagnose problems quickly. We keep instrumentation to what we need to operate the service reliably; our product analytics are first-party rather than handed to ad networks.

Payments

Jettova does not store card data. Consumer and Teams billing runs through Stripe: card entry, processing, and storage happen on Stripe's side. We hold only the non-sensitive references Stripe returns (customer and subscription identifiers) needed to manage a subscription. Travel bookings surfaced in the product are completed on the booking partner's own checkout, so those card details never touch us either.

API security

The public API authenticates with per-key bearer tokens. We store only a SHA-256 hash of each key, never the key itself, and look up requests by that hash. Every key-gated call runs the same path: environment gate, key-format check, hashed lookup, and an atomic monthly usage meter that enforces the plan's quota (with optional idempotency for billable calls).

Requests are rate-limited with Upstash Redis using a sliding-window limiter, keyed by API key or by IP for anonymous traffic, to contain abuse and protect capacity.

Data lifecycle

We keep what's needed to plan and save trips, and we deliberately drop what we don't need. When you scan a receipt for expense splitting, the image is processed by our AI processing step and then discarded. Only the structured fields (merchant, total, currency, line items) are kept, never the image bytes.

Leaving is self-serve. You can delete your account and its data yourself, anytime, at /delete-account. Teams owners and admins can export their organization's data through the org console. Deleting removes your personal data rather than hiding it behind a flag: your own records are deleted, and the few that must stay for financial or audit reasons, such as payment records, are kept with your name and contact details removed.

Reporting a vulnerability

If you think you have found a security problem in Jettova, email security@jettova.com. Tell us what you found, where, and the steps to reproduce it. A person reads every report, and we will tell you when we have confirmed it and when it is fixed. Please give us a reasonable time to fix it before you share it with anyone else.

Research in good faith is welcome. Use only your own accounts and test data, take the smallest action that shows the problem, and stop and tell us if you reach anyone else's data. Do not run denial-of-service or automated scanning that degrades the service, and do not try phishing or social engineering against our users or staff. We do not run a paid bug bounty.

Certifications & roadmap

We want to be straight with you about where we are. Jettova is not currently SOC 2 certified. A SOC 2 Type II examination is on our roadmap, not yet completed, and we won't claim it until an auditor has. We likewise do not currently hold ISO 27001 or PCI DSS certification; card handling is delegated to Stripe, which is itself PCI-compliant.

What is true today: we operate GDPR-aligned practices: data minimization, self-serve deletion and org export, first-party analytics, and processing through named sub-processors under contract. If your procurement needs specific attestations, contact us and we'll tell you honestly what we can and can't provide right now.