Security
Where your data lives, who can reach it, how it is backed up and how it is deleted. In plain words, from the decisions we actually made.
Where it lives
- Servers
- UpCloud, Helsinki. A Finnish company under EU law. No US cloud in the path.
- Operator
- Jourier Oy, Helsinki. Contact aleksi.stenberg@jourier.com.
- Stack
- Kubernetes on Talos Linux, an immutable operating system with no SSH. Postgres for every workspace. Everything defined in Git and applied from it.
- Sign-in
- Microsoft Entra ID or Google. Jourier stores no passwords. Sessions are bound to your workspace address.
One workspace per customer
Your workspace is a self-contained unit on the cluster. Nothing in it is shared with another customer.
- Database
- Your own Postgres instance with its own credentials. No shared tables, no shared connection.
- Storage
- Your own bucket for files and report packs.
- Secrets
- Your API keys sit in a vault path only your workspace can read. Keys arrive through the workspace, never through e-mail or chat.
- Network
- Traffic between workspaces is denied by default. Each workspace lists the flows it needs; everything else is dropped.
- Compute
- Every workspace runs under its own quota. One customer's load cannot starve another's.
- Pods
- An admission policy refuses host access, privileged containers and privilege escalation in every customer namespace, whatever the workspace's own manifests say.
Who can see what
- Members
- People on your verified e-mail domain are internal members. Admins manage the workspace; others see the dashboards granted to them.
- External people
- An accountant, a consultant or a board member sees only what is granted. They are never admins, and their access ends on the date you set, ninety days by default.
- Development tokens
- A developer's token carries that developer's permissions and nothing more. It lasts thirty days and dies with their membership.
- Jourier staff
- Administrative actions on the console require a fresh sign-in with multi-factor authentication. Every action is logged.
Backups
- Database
- A base backup every night and a continuous log of changes in between. Point-in-time restore to within five minutes.
- Off the cluster
- The backups are copied to a second location every night. That copy is never deleted by the job that writes it.
- Cluster state
- The cluster's own state is snapshotted every six hours and kept for fourteen days, outside the cluster.
- Source of truth
- Your workspace is a derived copy of your systems. In the worst case it is rebuilt from Netvisor, HubSpot or whichever source feeds it.
Deleting a workspace
Deletion is irreversible, so it is slow on purpose.
- Archive first
- A workspace is archived before it can be deleted. Archiving is reversible.
- Two keys
- A Jourier administrator orders the deletion after a fresh multi-factor sign-in. A second, offline key signs the order. Neither alone is enough.
- 24 hours
- A signed order waits a day and can be cancelled. Cancelling destroys the signature.
- What goes
- The database, the dashboards, the storage, the secrets, the namespace and every user who belongs to no other workspace. Nothing is recoverable afterwards.
- Who runs it
- A separate process with its own identity. The internet-facing service cannot delete anything.
Leaving
- Your data
- Export it from the workspace at any time. The API never removes or renames what it already answers.
- Your front end
- If you connected a repository, it stays yours under the MIT licence. Disconnecting returns the workspace to Jourier's interface at once.
- The whole workspace
- It runs on plain Kubernetes and Postgres and can be lifted out to your own cloud. We have done it.
Reporting a problem
Write to aleksi.stenberg@jourier.com. A person reads it the same day. If you found a vulnerability, say so in the subject line and we will get back to you before anything else.
Start with your own workspace.
Sign in with Microsoft or Google. Your workspace is ready the same day. Free for a month.