Workspace isolation
Each organisation receives a dedicated subdomain and workspace. Tenant context is resolved from the signed-in session and verified host. Automated tests check that one workspace cannot access another's records.
Trust
Security and trust
Jorip handles personal information about applicants, participants, customers, beneficiaries, staff and citizens. This page explains how we protect it.
Access control
Custom workspace roles and separate project roles, built from a published permission catalogue. Every action is authorised on the server. Session inventory, remote sign-out and security history are available to every member.
Data protection
Production configuration requires HTTPS, strict transport security, secure cookies and configured upload scanning. Provider secrets and SMTP credentials use encrypted storage. Browser drafts use encryption where WebCrypto and IndexedDB are available; fallback storage is unencrypted. Uploads are type-checked and hashed; scan results control file availability. Deployment configuration and operational checks remain essential.
Integrity and audit
Published forms are immutable. Submissions are never overwritten. Corrections create a new revision with a visible comparison. Every administrative change is written to a searchable audit log.
Privacy controls
Consent records, respondent privacy notices, access, correction and deletion requests with due dates, configurable retention, legal holds and a compliance evidence export.
AI governance
Provider-backed question generation requires a platform feature flag, workspace AI enablement and an explicit user request. Governed analysis also requires its execution policy, authorization and credit controls. Restricted fields are blocked from the deterministic open-text baseline; provider safeguards vary by workflow, and provider terms must be reviewed before restricted data is sent.
Support access
Support access uses reasoned, time-limited grants approved by your workspace owner, with recorded support actions. Platform administrators also have specific security, governance and billing permissions. Emergency access uses a separate approval workflow.
Reliability
Service health checks, retry handling, maintenance controls and tenant-impact status mapping support operations. Backup and restore certification is still in progress.
Responsible disclosure
We are preparing a dedicated security reporting channel and disclosure guidance for external researchers.
Certifications
We do not currently hold ISO 27001 or SOC 2 certification. We will list certifications only once they are awarded.