Security

Security is core to what JML does. Our product is the roster and the proof for who should have access — so we take the same discipline to the platform itself.

Authentication

• Email and password authentication backed by industry-standard hashing.
• Server-rendered sessions with httpOnly cookies; no long-lived tokens stored in the browser.
• Self-service password reset with one-time, expiring links.
• SSO when enabled on your tenant.

Authorization

• Role-based access control with seven roles (owner, admin, technician, HR manager, hiring manager, auditor, member).
• Row-level security policies enforced inside Postgres so no query can return another organization's data, regardless of application bugs.
• Sensitive operations require an explicit role check on the server before any database call.

Data protection

• All traffic is encrypted in transit using TLS 1.2+.
• Data at rest is encrypted by our managed database provider (Supabase / Postgres).
• Backups are taken automatically and retained according to our provider's standard policy.

Multi-tenant isolation

Every row of customer data is scoped to an organization_id. RLS policies and the active-organization context ensure data from one tenant is never visible to another, even for shared system tables.

Audit trail

Lifecycle requests, approvals, task completions, and permission changes are recorded in an immutable activity feed that workspace auditors can review and export at any time.

Responsible disclosure

If you believe you've found a security vulnerability, please email security@usejml.com. We'll acknowledge your report promptly and work with you on a fix before any public disclosure.