Jarel
Security
Free to start. No credit card.
Controls
These handle workspace data in the normal course of the product.
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Account details, workspace content, uploaded documents, audit log | EU (Dublin, Ireland) |
| Vercel | Hosting, edge network and the AI Gateway that routes model requests | All requests to the app, including prompts and documents in transit | EU (Dublin) for the application; the edge network is global |
| OpenAI | Text generation (GPT-6 Luna), voice and embeddings | Prompts, document excerpts, audio for voice | US |
| Cohere, through the Vercel AI Gateway | Reranks search results so the best passages reach the model | Search queries and the retrieved passages | To be confirmed |
| Inngest | Runs background jobs such as document processing and routines | Job parameters such as workspace, document and task identifiers | To be confirmed |
| Sentry | Error monitoring | Error reports with emails, tokens and document text scrubbed | EU (Germany) |
| Resend | Transactional email such as invites and notices | Recipient name and email, and the message sent | EU / US |
| Stripe | Subscriptions and payments | Billing contact, plan and payment details; card data stays with Stripe | To be confirmed |
| PostHog | Product analytics | Pseudonymous usage events with allow-listed properties | EU |
| Cloudflare | Bot protection (Turnstile) on sign-in and public forms | IP address and browser signals during the challenge | To be confirmed |
| Managed Redis for rate limiting | Counters that cap request rates | Request counters keyed by user or IP address | To be confirmed |
These see workspace data only when a member or an admin uses the feature, or the switch is on.
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Mixedbread | Document search indexing, and a fallback reranker | Text of public and internal documents when indexing is switched on; queries and passages when it reranks. Never documents marked confidential or restrictedDocument indexing is a deployment switch and is off unless enabled. Reranking is the fallback if the primary reranker is unavailable. | To be confirmed |
| Composio | Connects the apps and plugins you choose | The action you approve and the connection to your account in that appWhen a member connects an app or runs a plugin action. | To be confirmed |
| Fly.io | Isolated browser sessions for agent computers | Pages the agent opens, files it downloads and the saved sign-ins you addOnly for workspaces with agent computers enabled. | To be confirmed |
| Expo | Delivers push notifications to the Jarel mobile app | Device push token and the notification textWhen a member turns on notifications in the mobile app. | To be confirmed |
| Google and Apple sign-in | Sign-in for members who choose it | Name and email address from the account you pickWhen a member signs in with Google or Apple. | To be confirmed |
| Apple App Store | Mobile in-app subscriptions | Purchase and subscription receipts for the accountWhen a plan is bought through the iOS app. | To be confirmed |
| Typesafe (Jev), through the Vercel AI Gateway | Quick yes or no checks that decide how an agent proceeds | Structured agent state, such as the task and recent stepsOnly when the JEV_DECISIONS_ENABLED switch is on. It is off by default. | To be confirmed |
These never see workspace data. They apply to visitors of jarel.se.
| Vendor | Purpose | Data | Region |
|---|---|---|---|
| Google (Tag Manager, Analytics, Ads) | Website analytics and advertising measurement | Pseudonymous page views and ad clicks on jarel.seOnly on the public website, and only after the visitor accepts the cookie banner. | To be confirmed |
| Meta | Advertising measurement (Meta Pixel) | Pseudonymous page views and ad clicks on jarel.seOnly on the public website, and only after the visitor accepts the cookie banner. | To be confirmed |
Updated 9 October 2026. “To be confirmed” means we have not yet checked that detail with the vendor, and we would rather say so than guess. Ask security@jarel.se for the vendor agreements we hold.
FAQ
Customer content is not used to train Jarel models. Model providers are configured not to train on it where their terms support that.
Workspace data is stored in Dublin, Ireland. Some processors, including our AI model provider, process data outside the EU. The subprocessor list shows where.
Only people in your workspace. Storage and access are scoped to the workspace, and reads, writes and AI calls are logged where available.
Not yet. SOC 2 Type II, ISO 27001 and ISO 42001 are planned; no audit has started and no report exists. The status rows above say exactly where each one stands.
Yes. Both are available on request. Write to security@jarel.se.
Free to start, no credit card. Connect your documents and read the work, with its sources, before anything is sent.
An example task: Review the data room and tell me what blocks signing on 16 October.
Try Jarel free