Security
Security is a design decision, not an afterthought
How JWS protects your account, your data and your infrastructure.
Tenant isolation
Every customer's data and infrastructure is isolated from every other customer's, enforced at the database level with row-level security (RLS), not just application logic.
- Row-level security on every multi-tenant table
- No cross-tenant data access by default
- Isolation verified as part of internal review
Secrets handling
JWS is designed to never store the plaintext values of your application's environment variables longer than needed to deploy them, and sensitive platform secrets are encrypted at rest.
- Environment variable values are never logged
- Encrypted storage for 2FA secrets and platform credentials
- Secret values are redacted in support tooling
Authentication
Account access is protected with modern authentication controls, including optional two-factor authentication and full visibility into active sessions.
- Two-factor authentication (2FA) available on every account
- Session revocation from any device
- Login activity is visible to the account owner
Access control
Team access follows the principle of least privilege, with role-based permissions and a clear, auditable process for transferring project ownership.
- Role-based access control (RBAC) for team members
- Explicit ownership transfer flow
- Granular permissions per project
Audit logging
Significant account and infrastructure actions are recorded so you and the JWS team can reconstruct what happened and when.
- Deployment and configuration changes are logged
- Access and permission changes are logged
- Logs support incident investigation
Infrastructure security
Underlying infrastructure is isolated per workload where appropriate, and every custom domain gets automatic SSL.
- Automatic SSL on custom domains
- Workload isolation on managed infrastructure
- Regular platform security review
Import safety
When JWS analyzes a project you import, it performs static analysis only — it reads your code to understand it, and never executes it during the analysis phase.
- Static analysis, not code execution
- Detected environment variables are never auto-filled with guesses
- You approve every deployment before it goes live
Responsible disclosure
If you believe you've found a security issue with JWS, we want to know about it before anyone else does.
- Report security issues through our abuse report channel
- See /abuse-report for how to reach us