Security & Trust
Where your data
actually goes.
Trust starts with being specific. Here's what each tier does with data, which services help us run the website, how long we keep things, and how to reach us about a security concern.
By tier
Three tiers, three answers.
01 · Business Assistants
- Answers come from a fixed knowledge base — no language model, no third-party AI provider.
- On this website, the sample assistants run entirely in your browser.
- Conversations with client assistants are stored only where the client agrees, for lead capture and quality.
02 · AI Assistants
- Questions and the relevant document passages are sent to a language model provider to write each answer.
- We only use providers whose business API terms do not train models on your data.
- The provider used for each deployment is named in your proposal and on our sub-processor list.
03 · Private AI
- An internal tool for your employees, not a public-facing assistant.
- Models, documents and logs run inside your own infrastructure.
- No outside model provider receives your data.
- Access follows the permissions your documents already have; activity can be logged in your environment.
Practices
How we handle it.
Encrypted in transit
Everything between your browser, our site and our providers travels over HTTPS.
Least access
Stored submissions and conversations are accessible only to us, not to the public or other clients.
Retention
Contact requests and Nova conversations are kept for up to 24 months after our last contact, unless you ask us to delete them sooner.
Honest scope
We don't currently hold SOC 2 or ISO 27001 certification. For regulated or health data, Private AI or a non-patient-data scope is the right starting point — we'll be clear about this in your consultation.
Sub-processors
Who helps us run it.
These services process data on our behalf for this website and our own assistant, Nova. See the Privacy Policy for details.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Website hosting and cookie-free analytics | United States |
| Supabase | Database for contact requests and Nova conversations | United States |
| Resend | Delivers notification emails to us | United States |
| Google (Gmail) | Business email inbox | United States |
| AI model provider | Tier 02 answers — named per project in your proposal | Per project |
Report a concern
Found something?
If you believe you’ve found a security issue with this site or one of our assistants, email jeremy@jcnstudio.com with “Security concern” in the subject. We’ll acknowledge it within two business days.
Questions about
your data?
Bring your security requirements to the consultation. We'll tell you plainly which tier meets them — and which doesn't.