Security

How Jamdesk protects your documentation and account data.

Infrastructure Security

Hosting

Jamdesk runs on SOC 2-compliant cloud providers. Builds, application data, and compiled documentation live in managed, hardened services from those providers. A global CDN with built-in DDoS protection serves traffic.

Encryption

Data State	Protection
In transit	TLS 1.3 between you, our edge, and our origins
At rest	AES-256 for everything we persist, including database records, object storage, and logs
Backups	Encrypted with the same keys and replicated across multiple regions

Access Controls

You can sign in to the dashboard with email and password or with single sign-on through Google or GitHub. Our authentication provider keeps only one-way password hashes, never plaintext.

MFA on your Google or GitHub account (TOTP, security keys, passkeys) also applies to Jamdesk sign-in through that account. For the strongest protection, turn on MFA there and sign in with SSO.

Team Access

Role-based access (Owner, Admin, Member) is enforced in our database security rules and on every backend call. Sessions expire after periods of inactivity. Changes to billing, members, custom domains, or API keys are written to a per-project audit log.

GitHub Integration

Jamdesk connects to your repositories through a GitHub App with these permissions:

Read and write access to repository contents
Webhook delivery for build triggers

Jamdesk writes to your repository only when you ask it to: saving changes in the dashboard editor, accepting Fix with AI suggestions, or turning on translation (it commits translated pages). Builds only read. Revoke Jamdesk's access at any time from your GitHub Applications settings.

Tokens and Secrets

We encrypt every secret at rest, including:

GitHub App connections, where we keep only your numeric installation ID. Short-lived installation tokens (valid for one hour) are minted on demand and never persisted.
GitHub OAuth tokens from the starter-repo flow. We exchange each token once, use it to clone the template, and discard it.
Third-party integration credentials such as Slack incoming-webhook URLs, custom-domain verification tokens, and analytics API keys.

The dashboard never returns these values to the browser after saving. Only the server-side build pipeline can read them.

Programmatic API keys are stored as one-way hashes. The plaintext is shown to you exactly once at creation time. If you lose it, rotate the key.

Data Handling

What We Store

Your docs.json configuration and any uploaded branding assets
Compiled documentation (HTML, CSS, JS)
Build logs, retained for 30 days
Page-view events for your documentation site (path, referrer, country, browser, device type and a per-tab session ID), deleted after 90 days. Page views recorded since October 14, 2026 carry no IP address
AI chat questions (the first 200 characters, without the answer), deleted after 30 days
Encrypted secrets for any third-party integration you have configured

What We Don't Store

Your source code. We clone the repository at build time. The working tree is discarded with the build container.
Long-lived GitHub credentials. See Tokens and Secrets above.
User passwords in any reversible form.
Payment card numbers. Stripe holds all card data. We keep only the customer ID and subscription metadata.

Internal Access

Production data access is limited to a small number of employees who need it to operate the service or respond to support requests. Access is logged.

Build Isolation

Each documentation build runs in a dedicated container:

No access to other customers' data
Fresh environment for every build, with secrets injected just-in-time
Container is destroyed after the build completes or fails

Compliance

Is Jamdesk GDPR compliant? Yes. Jamdesk meets GDPR requirements with:

A Data Processing Addendum that applies automatically, with a countersigned copy available on request from privacy@jamdesk.com
A public list of subprocessors at jamdesk.com/subprocessors
Right to deletion honored within 30 days
Data portability through export

Privacy

Our built-in analytics:

Don't use cookies. A random session ID lives in the browser's session storage until the tab closes
Don't share data with advertising networks
Don't record visitor IP addresses

See our Privacy Policy for details.

Incident Response

Our response to a security incident affecting your account or data:

Investigate and contain the issue.
Notify affected customers within 72 hours, in line with our GDPR obligations.
Provide a written post-incident report after the cause is confirmed.

Reporting Vulnerabilities

Report security issues responsibly:

Email security@jamdesk.com
Include a description, steps to reproduce, and an impact assessment
We'll acknowledge within 48 hours

We don't run a paid bug bounty program. We credit researchers who report in good faith.

Questions?

Contact Support

Security questions