Security
Security built around your assessments.
Jumbi is designed for a simple promise: checking whether your code is ready to ship should never make that code harder to protect. These controls describe the public posture of the product today.
Last updated · October 23, 2026
Transport
TLS
Encrypted traffic in production
Storage
RLS
Account-scoped database access
Training
No
Your content is never used to train models
Controls
What protects your data
The controls below cover the public site, the signed-in app, the database and the assessment service that scores your code.
Privacy by default
Assessments, findings and action plans are scoped to your account. Jumbi never sells them or uses them to train models.
Encrypted transport and storage
Production traffic is served over TLS, and your assessments are encrypted at rest in the database.
Scoped data access
Supabase row level security keeps every assessment and setting tied to the account that owns it.
Key separation
Public browser keys and server-only service keys are kept apart in environment configuration, and server keys never reach the browser.
Input validation
API routes validate request bodies before they reach assessment, storage or email code.
Account control
Export your assessments as JSON, change your settings or delete your account and everything in it from settings.
Development
Secure development practices
Security is enforced in the implementation path rather than handled as a separate checklist at the end.
- Validate every public API input before business logic runs.
- Keep authentication and authorization checks at route boundaries.
- Score assessments with our own rules, without sending your code to an outside AI provider.
- Keep a seeded demo mode so the product can be explored without real data.
- Run type, lint, test and build checks before production changes ship.
Customers
How to help keep your account secure
Accounts
Protect credentials
Use a strong, unique password, avoid shared accounts and tell us at once if you suspect someone else has access.
Assessments
Review before you act
Treat scores, gaps and plan steps as a starting point. Check each finding against your code before you change production.
Disclosure
Report issues quickly
Send security findings through the vulnerability disclosure policy.