Your code
Jam only touches your repository if you install the Jam GitHub App, and only the repositories you select when you install it. You can change that list or uninstall the app from GitHub at any time.
Jam writes each article to a new branch and opens a pull request against your base branch. It never pushes to your main branch and never merges. Nothing reaches your site until someone on your team merges it.
- Branches
- Every change goes on its own new branch, named jam-geo/.
- Merging
- Always yours. Jam never merges a pull request.
- Access tokens
- Short-lived, about an hour, and limited to the repositories you selected.
- Without GitHub
- Every draft is Markdown you copy or download. Jam needs no repository access at all.
Connected accounts
When you connect Google Search Console, Jam reads your sites, your search performance and URL inspection results. It does not change anything in Search Console.
Tokens for the accounts you connect, such as Slack or Discord, are encrypted with AES-256-GCM before they are written to the database.
Where data lives
Your workspace data is stored in a Postgres database run by Supabase, in the United States. The Jam app and its background workers run on Railway.
- In transit
- Every page and API call is served over HTTPS.
- Stored secrets
- OAuth tokens and webhook secrets are encrypted in the application before storage.
- Card details
- Handled by Stripe Checkout. Card numbers never reach Jam.
Access controls
You sign in with Google or with a one-time link sent to your email, through Supabase Auth. Every request is checked against the workspace it belongs to on the server.
Row-level security is turned on for the database as a backstop, so the browser cannot read tables directly. A daily check confirms it is still on.
- Support access
- Limited to Jam admins, ends after eight hours, and every session is written to an audit log.
- During support
- An admin cannot connect or disconnect your integrations.
API keys and agents
API keys are shown once, when you create them. Jam stores only a keyed hash, so a key cannot be read back, even by us. Each key belongs to one workspace and can be revoked from Settings at any time.
A key cannot create other keys, so a leaked key cannot mint its own replacement. When Claude or ChatGPT connects over MCP, you sign in and approve it on a Jam page, and the connection shows up in Settings as a key you can revoke.
- Webhooks
- Every delivery is signed. Payloads carry ids and a dashboard link, never drafts or pull request contents.
- Webhook URLs
- Public https only. Private, loopback and cloud metadata addresses are refused.
- Inbound events
- Events from GitHub and Stripe are rejected unless their signature checks out.
Subprocessors
The services that process data so Jam can do its work.
| Provider | What it does for Jam | When |
|---|
| Supabase | Database and sign-in | Always |
|---|
| Railway | Hosts the Jam app and its workers | Always |
|---|
| Inngest | Runs scheduled scans and background work | Always |
|---|
| Stripe | Billing and checkout | When you pay |
|---|
| Anthropic | AI models, and Claude tracking | Always |
|---|
| OpenAI | AI models, and ChatGPT checks | Always |
|---|
| Google | Gemini models and checks | Always |
|---|
| Perplexity | Perplexity checks | Always |
|---|
| cloro | Collects AI answers for the prompts you track | Always |
|---|
| DataForSEO | Search keyword data | Always |
|---|
| Tavily | Web search during research | Always |
|---|
| E2B | Isolated sandboxes for work on your repository | When Jam works on your repository |
|---|
| Resend | Email | Always |
|---|
| Axiom | Logs and traces | Always |
|---|
| PostHog | Product analytics | Always |
|---|
| GitHub | Branches and pull requests | When you install the app |
|---|
| Composio | Holds the Google Search Console connection | When you connect it |
|---|
| Slack, Discord, Telegram, Sendblue | Delivers messages to the apps you choose | When you connect them |
|---|
Retention and deletion
Your data stays while your workspace is active. An owner can delete a workspace from its settings; Jam then removes its data in the background.
Notifications are deleted after 90 days. To delete your account, or for any other data request, email [email protected].
Compliance
Jam is not certified yet. This is the work underway, and this page will change as each item is done.
SOC 2 Type IIIndependent audit of our security controls.
In progressISO 27001Certified information security management.
In progressGDPR DPAA data processing agreement you can sign.
In progressPenetration testingA test by an outside firm.
In progressTrust centreOne place for reports and policies.
In progress
Reporting a vulnerability
If you find a security issue, email us with the details and steps to reproduce it. We will reply and keep you posted while we fix it. Please give us time to fix it before you share it.
[email protected]