Jarel
What Jarel does with your work, what you can verify yourself, and where our security program stands. Nothing here is listed before it exists.
PDF, two pages. Updated 9 October 2026.
Documents, prompts and generated content are not used to train Jarel models. Model requests go only to approved providers, under no-training terms where the provider offers them.
Customer data is stored in the EU. The production database runs in Dublin, Ireland. Other regions are offered only when enabled for a workspace.
Traffic is encrypted with TLS. Data at rest is encrypted with AES-256 by our database and storage provider, and documents sit in a private bucket.
Actions that change something outside Jarel need a person to approve the exact request. It is approved once and checked again before it runs.
Privileged actions are written to a hash-chained audit log. Workspace admins can export it and verify that it has not been altered.
The controls behind the commitments, and where you can see each one for yourself.
| Area | What it does | Check it |
|---|---|---|
| Tenant isolation | Row-level security on tenant tables in the database. Isolation tests run in CI on every change. | Ask us for the isolation test list. |
| Sign-in | Two-step sign-in with an authenticator app and recovery codes. Account lockout, rate limits and a bot challenge on sign-in. | Settings, Security. |
| Audit log | Append-only, hash-chained events for privileged actions, approvals and AI review decisions. | Export as CSV and run the verify check as an admin. |
| Your data rights | Self-serve export of your data. Hard delete for admins, with the deletion recorded. | Settings, Compliance. |
| Browser protection | Strict content security policy with per-request nonces on app pages. HSTS on. Cookie sessions need a same-origin check. | Visible in the response headers of any app page. |
| Logs and error reports | Error reports and server logs are scrubbed of emails, tokens and document text before they leave Jarel. | Ask us for the redaction rules. |
| Server requests | Server-side fetches go through a guard against internal addresses. Uploads are checked for their real file type. | Ask us for the test list. |
| Changes to the code | Secret scanning, static analysis and a dependency audit run on every change before it can merge. | Ask us for the CI summary. |
We list a report, certificate or test here only after it exists. An internal code and configuration review was done in October 2026. It is not a penetration test and does not replace one.
A person answers.
Found a vulnerability? See our disclosure policy.
Začít je zdarma, bez platební karty. Připojte své dokumenty a přečtěte si práci i se zdroji, než se cokoli odešle.
Ukázkový úkol: Zkontroluj datovou místnost a řekni mi, co brání podpisu 16. října.
Vyzkoušejte Jarel zdarma