How does JamBots keep my data and accounts safe?
JamBots encrypts every credential at rest, never returns a saved key through the API, and never puts one in a model's context. Each workspace is isolated by row-level security in the database. A bot must get approval before any consequential action, and unanswered approvals expire after 10 minutes.
Which security controls does JamBots use?
| Area | Control |
|---|---|
| Credentials | Encrypted at rest with AES-256-GCM; the API returns only a masked hint after saving; never placed in model context |
| Workspace isolation | Row-level security on every workspace table in the database; nothing crosses workspaces unless shared on purpose |
| Consequential actions | Approval required before sending, buying, deleting, posting or writing to outside systems; unanswered approvals expire after 10 minutes |
| Outside actions | Recorded before they run and never replayed automatically; if an outcome is uncertain, the bot asks |
| Network access | Requests from tools and connectors to private network addresses are blocked |
| Computers | Each bot gets its own computer; sharing one between bots is an explicit choice |
| Sign-in | Sign-up and sign-in are rate limited per IP address and per account; email is verified |
| Metering | Every model call is recorded against a workspace with tokens and cost |
Security questions
How does JamBots protect my API keys?
Model keys and other credentials are encrypted at rest with AES-256-GCM. After you save one, the API only ever returns a masked hint, never the value. Credentials are never placed in a model's context, and automated tests check that a planted secret never reaches a log, an event or a message.
Can one workspace see another workspace's data?
No. The workspace is the security boundary. Bots, threads, memory, computers, connections and files never cross between workspaces unless a person shares them on purpose. The database enforces this with row-level security on every workspace table, so a bug in one query cannot read another workspace's rows.
What stops a bot from doing something I did not want?
A bot must get approval before any consequential action, such as sending, buying, deleting, posting or writing to an outside system. Workspace rules can pre-approve safe actions. An approval nobody answers expires after 10 minutes and the action does not run. Every outside action is recorded before it runs.
How do I report a vulnerability?
Email security@jambots.ai with the steps to reproduce. We reply to every report.