Security
Last updated November 6, 2026
Draft for review. This page describes how Jandshake works today. It hasn't been reviewed by a lawyer yet and may change before public launch.
People trust Jandshake with fundraising decks, financial models and deal documents. Here's how we protect them, and how to report a problem.
How we protect your data
- All traffic is encrypted with HTTPS. Data is encrypted at rest by our storage and database providers.
- Documents are served only through short-lived, signed addresses, after the link's rules (email check, allowed domains, NDA, expiry) have passed.
- The application connects to its database with its own limited role, and each organization's data is kept separate in every query.
- IP addresses are stored only as keyed one-way hashes.
- A strict content security policy, and security headers on every page.
- An audit log of sign-ins, sharing changes and document access for each organization.
- Database backups with point-in-time recovery from our database provider, and documented restore steps.
- An independent penetration test before general availability.
Reporting a vulnerability
If you think you've found a security problem, email joshua@turnrow.solutions with the steps to reproduce it and what an attacker could do. Please don't share it publicly until we've fixed it. We'll acknowledge your report within 3 business days and keep you updated until it's resolved.
Good-faith research
We won't pursue legal action against research that follows these rules:
- Test only against your own accounts and data.
- Don't access, change or keep other people's data. If you reach some by accident, stop and tell us.
- Don't degrade the service: no denial-of-service, spam or social engineering of our staff or customers.
- Give us reasonable time to fix the problem before you disclose it.
Contact
Security reports: joshua@turnrow.solutions.