Security at Jasper

Signing in

• Two-factor sign-in with an authenticator app, one-time recovery codes, or a passkey.
• An organisation owner can require two-factor sign-in for everyone in the organisation, after a grace period.
• Sensitive actions ask you to confirm again before they go ahead.
• Connections to Jasper use HTTPS, and the site tells browsers to keep using it.

Your files

• Files uploaded to chat, wikis and tasks are scanned for malware before anyone can open them. A file that fails the scan is quarantined and never served.
• Mailbox and calendar passwords and access tokens are stored encrypted in our database.

Control for organisations

• An organisation can limit sign-in to approved IP addresses.
• Audit logs record sensitive actions, and each organisation chooses how long they are kept, from 30 days to 5 years.
• Pages are sent with browser protections against being framed by other sites.

Your data

• Anyone can ask for their account to be deleted, from the app or on the delete account page. The account is erased after 30 days, and you can cancel before then.
• You can download a copy of your personal data before you delete it.

Is Jasper up?

The status page shows the web app, API, realtime and mail sync as they are now, with past incidents.

Report a vulnerability

Email [email protected] with the details and please do not open a public issue. Our security.txt has the same address.