Trust Centre
Security and trust at Jojan One
We handle sensitive compliance data. Here is exactly how we protect it.
- UK GDPR
- EU Data Residency
- AES-256 at Rest
- Row Level Security
How we protect your data
Encryption
All data is encrypted at rest using AES-256 by our infrastructure providers, covering the production database, its automated backups and uploaded files. All traffic is protected using TLS 1.2 or higher, and insecure connections are rejected.
European infrastructure
The application runs on Vercel. Your business records, accounts and uploaded files are held in Supabase, which provisions managed PostgreSQL on AWS, and our production project is provisioned in a European region. We do not transfer personal data outside the UK or EEA without adequate safeguards and a lawful basis.
Access controls
Access inside a workspace is role-based, and every table is protected by PostgreSQL Row Level Security, so one workspace cannot read or write another's records even if the application code above it is wrong. We require multi-factor authentication on the provider accounts that hold production access.
Compliance
We act as a data controller for our own business data and as a data processor for the data you upload to the platform. Our Data Processing Agreement is available for review and signing.
Independent testing
We have not yet commissioned an independent penetration test. Engaging a CREST-accredited assessor, and publishing a summary of the findings and their remediation, is on our roadmap. Every data feature does ship with an automated test that provisions two separate tenants and asserts neither can reach the other's records.
Incident response
If a security incident affects personal data we hold on your behalf we will notify you without undue delay, and within 72 hours of becoming aware where UK GDPR requires it, and we will cooperate fully with any regulatory response.
Standards we are working towards
Jojan One does not hold these certifications today. We list them because they are the bar we are building to, and we will only claim one once it has been awarded.
ISO 27001
Information security management - in progress
SOC 2 Type II
Security, availability and confidentiality - planned
UK GDPR
Data protection compliance - our operating standard today
Cyber Essentials Plus
UK government-backed certification - planned
Need our security documentation?
Request our Data Processing Agreement or our sub-processor list.
Questions about trust and compliance?
Our data protection contact and the engineering team behind the platform are available to answer any questions you have.