Encryption at rest
Connector and LLM credentials are encrypted by the application with Fernet using workspace-derived keys. Credentials are not returned in API responses or written to ordinary logs. Storage-provider and backup encryption must be confirmed for the specific deployment.
Encryption in transit
Production traffic is served over HTTPS through Nginx with HSTS enabled. External connectors and providers are responsible for their own transport guarantees; Jovis uses HTTPS/TLS endpoints where supported and validates provider-specific authentication flows.
Authentication
Users authenticate with email one-time passwords. OTPs are short-lived, rate-limited, deleted after successful verification, and protected against repeated failed attempts. Sessions use opaque Redis-backed tokens.
Authorization
Workspace membership and role checks are enforced in the service layer. Owners, admins, and members receive different capabilities; public pages do not grant workspace access.
Tenant isolation
Workspace data, agents, connector configuration, billing records, and execution context are scoped to the authenticated workspace. Membership is rechecked at protected boundaries, including connector and background-work paths.
Connector permissions
Connectors are registered through a shared provider architecture. Tool catalogs are built from the current caller’s authorized workspace bindings. SQL connectors use read-only query safety, and mutations require application-owned validation and approval controls.
Data retention
Retention depends on the data type and product workflow. Workspace owners can manage content and connectors. Security approval evidence is retained for documented investigation windows, while ambiguous email and provider outcomes remain visible for reconciliation rather than being silently retried.