Security
Your business data, safe with us
Security isn't a feature — it's the foundation. Here's exactly how we protect your data, and the standards we hold ourselves to.
Encryption everywhere
All data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Your passwords are hashed with bcrypt. Payment data never touches our servers — it's handled by PCI-DSS Level 1 certified processors.
Access control
Access to production data is restricted to authorized engineers on a least-privilege basis. Every access is logged and audited. We use hardware security keys for all internal authentication.
Secure infrastructure
Jobby runs on enterprise-grade cloud infrastructure with automatic backups, multi-region redundancy, and 24/7 monitoring. Our infrastructure undergoes regular penetration testing by independent firms.
Data ownership
You own your data. You can export it anytime and delete it anytime. We never sell your data to third parties. We only share data with integration partners when you explicitly connect them.
Transparency
We publish our security practices, notify you of breaches within 72 hours, and maintain a public status page. You can request a copy of our SOC 2 report by contacting security@jobby.com.
Compliance
We're SOC 2 Type II certified and GDPR/CCPA compliant. We undergo annual audits and continuous monitoring to maintain our certifications.
Our security practices
- Annual SOC 2 Type II audit by an independent CPA firm
- Quarterly penetration testing with remediation tracking
- Bug bounty program with rewards up to $5,000
- 24/7 security monitoring and incident response
- Employee security training every 6 months
- Automatic security patching within 48 hours of disclosure
- Multi-region backups with 99.999999999% durability
- Privacy-by-design review for every new feature
Certifications and compliance
SOC 2 Type II
Certified
GDPR
Certified
CCPA
Certified
PCI DSS
Certified
ISO 27001
Certified
Security questions
Is my data encrypted?
Yes. All data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Payment data is handled by PCI-DSS Level 1 certified processors and never touches our servers.
Where is my data stored?
Your data is stored on enterprise-grade cloud infrastructure in the United States, with multi-region backups for durability. We never store data outside the US.
Who has access to my data?
Access is restricted to authorized engineers on a least-privilege basis. Every access is logged and audited. We never share your data with third parties without your explicit consent.
What happens to my data if I cancel?
You can export all your data anytime. After cancellation, your data is retained for 30 days in case you return, then permanently deleted. You can also request immediate deletion.
Found a vulnerability?
- We take security reports seriously. Email security@jobby.com with details and we'll respond within 24 hours. Eligible reports are rewarded through our bug bounty program.