Security controls, privacy terms, and service providers.
“Configured” reflects reviewed code and infrastructure settings, not an independent audit of the live service.
Firm storage enforces workspace paths; Ask document access is scoped to the signed-in account.
Sign-in cookies use Secure and HttpOnly protections.
Firm requests reject disabled users and revoked sessions.
TOTP two-step verification is available for Ask accounts (optional; you turn it on). Firm admins can enable it per workspace. It is not required by default.
Document storage uses AWS KMS encryption and blocks public access.
Document storage requires HTTPS; application websites redirect to HTTPS.
For every signed-in Ask account (Free, Pro, and Max), AI requests go only to AI providers that have committed to keep no data and not to train on it. Jurisio itself keeps raw model request and response logs for 180 days for quality and safety review. Guest requests made without signing in use a cost-optimized route that is not zero-retention; its providers may retain prompts and use them for training. Firm processing and contractual terms differ.
No formal internal data-handling policy established. Published privacy terms apply.
Core application tables have point-in-time recovery and deletion protection. No recovery-time commitment.
No published recovery-test results or validated recovery times.
No formal business continuity or disaster recovery plan established.
Ask authentication email is signed with DKIM, protected by an SPF record, and covered by a DMARC quarantine policy; these DNS records were checked live on 2026-09-29. Firm authentication-email DNS is managed outside this repository and was not verified in this review.
Company-wide email filtering and mailbox protections have not been verified.
Employee device encryption, anti-malware, and device management have not been assessed.
Document buckets block public access; application checks govern file access.
Cloud service permissions are defined in infrastructure code. A complete least-privilege review is not established.
Most cloud resources are defined in version-controlled infrastructure code; some DNS and email settings are managed separately.
The marketing site configures a content security policy and HTTPS security headers.
Operational logging and cloud monitoring are configured. Ask logs include model content.
Firm audit records use immutable storage with a separate retention period.
A written incident response plan is in place; it is internal and not published. Reports use the contact form; no emergency response time is promised.
Published privacy terms and product addenda define applicable commitments.
Written internal information-security and access-control policies are in place; they are internal and not published, and no independent audit has reviewed them.
A quarterly access-review process has started; the first review was run in September 2026. Employee training and signed policy records have not been assessed.
Key integrations are listed below. Active downstream AI hosts require further verification.
No documented risk-management or vendor-review program established.
No independent penetration-test report available.
Security reports use the contact form. Submit a non-sensitive summary first.
No published remediation schedule or bug-bounty program.
Try another term or clear the status filter.
Published terms and the status of internal policies and reports.
Internal policies are written but not published. Independent reports are not yet available.
Not yet. Jurisio has implemented SOC 2 Security-criteria controls and is preparing for an independent SOC 2 Type I audit (SOC 2 Type I — in progress), but no auditor has issued a SOC 2 report. Jurisio is not ISO 27001 certified. Technical safeguards described here are separate from independent certification. See Compliance status.
Document storage is configured with AWS KMS encryption at rest and HTTPS in transit. Jurisio’s application services can read content to deliver document and AI features. This is not end-to-end encryption.
Ask is governed by the Privacy Policy and Terms of Service, not a separate product addendum. Submitting information to Ask does not create attorney-client privilege. As a guest (without signing in), do not submit material you are not permitted to disclose to AI providers whose policies may permit retention or training; every signed-in account (Free, Pro, and Max) routes requests only to providers that have committed not to train on submitted content. Firm workspace terms are different. Review the Terms of Service before uploading sensitive material.
Jurisio itself never trains on your data. For Ask, requests from every signed-in account (Free, Pro, and Max) are routed only to providers that have committed not to train on submitted content. Guest requests made without signing in use a cost-optimized route whose providers may retain prompts and outputs and, under their own terms, use them to train or improve their models or products. Firm workspace processing is governed by the organization's written agreement. See Privacy Policy §4.
For signed-in accounts, yes, with AI providers: Jurisio sends requests only to AI providers that have committed to keep no data. Three limits apply. Guest requests made without signing in use a route that is not zero-retention. Jurisio itself keeps AI request and response logs for 180 days for quality and safety review. Documents and conversations you save stay in your account until you delete them. Separately, web searches send the search query, after a privacy check, to search providers, which are search services rather than AI model providers.
Deleting a workspace document does not immediately erase every related backup, log, or audit record. Retention varies by record type. Ask keeps documents until you delete them. When you delete one, its stored files are deleted right away and its database record expires within a few days; copies in database point-in-time recovery age out within 35 days; separate raw AI model logs have a 180-day lifecycle; and Firm audit records use immutable storage with multi-year retention (six to seven years depending on record type). Contact us about your specific deletion request.
Core infrastructure is configured in AWS US regions. AI requests and other features may involve external service providers. This page does not guarantee that all data processing stays in the United States or within AWS.
Firm customers can request a Business Associate Agreement (BAA) with Jurisio; HIPAA commitments apply only under a signed BAA. Ask is not offered for HIPAA-regulated use; don't upload protected health information to Ask.
Public privacy terms and product addenda are linked in Documents. Formal internal security policies and independent test reports are not yet available. You can request information about a specific safeguard or a prospective firm review.
Use Report a concern to open our existing contact form with a security-report topic. Include a non-sensitive description of the affected feature. Do not send credentials, confidential documents, or an exploit containing customer data. We do not promise an emergency response time or operate a published bounty program.
The Privacy Policy, Terms of Service, and applicable written agreements govern product commitments.
Key external services identified in the code. Use varies by product and configuration; this is not a complete, contract-verified subprocessor register.
Cloud infrastructure. Storage, databases, compute, authentication email, and model processing through Amazon Bedrock where configured.
Documents, account records, application content, and operational data relevant to the service.
AI processing. Routes model requests to downstream providers. The active provider can vary by workflow, model, and configuration.
Prompts, relevant document context, and model responses; for guest requests, providers may also receive a pseudonymous session identifier. A complete active downstream-host register is not yet verified.
Web research. Jurisio uses multiple search providers to search the web and extract web-page content for research workflows.
Search queries and requested URLs; the query may include context generated from a user request.
Payments. Handles payment and subscription workflows.
Billing details, account references, and subscription/payment records required for those workflows.
Product and website analytics. Measures general usage and platform performance; it never receives what you type. Session recording is disabled.
Allowlisted usage properties, device type and browser window size, plus request-level technical data described in the Cookie Policy, including an IP-derived daily identifier and approximate location; no question text, document contents, filenames, email, or account identifiers.
Sign-in, website fonts & Drive import. Google sign-in supports account access. Some public pages also request Google-hosted fonts. If you connect Google Drive, Jurisio imports only the files you pick and follows Google's API Services User Data Policy for that data.
Sign-in profile information where authorized; browser connection information when loading fonts. Connected-file data and authorization tokens when Google Drive is connected.
OneDrive import. Only used when you connect Microsoft OneDrive to import files into your Ask account.
Connected-file data and authorization tokens for the files you choose to import.
File import. Only used when you connect Dropbox to import files into your Ask account.
Connected-file data and authorization tokens for the files you choose to import.
File import. Only used when you connect Box to import files into your Ask account.
Connected-file data and authorization tokens for the files you choose to import.
Request the provider list and processing terms applicable to your workflow.
Request provider details