Security & Privacy
What actually protects your data
Security pages usually list aspirations. This one separates what is implemented today from what is not.
In place today
Encrypted in transit
All traffic between your device and our servers runs over TLS. Nothing is sent in plain text over the network.
Encrypted at rest
Your messages, profiles and uploads are stored on managed infrastructure with disk-level encryption.
Row-level access control
Every table enforces per-row policies. You can only read a conversation, message or membership row if you are a member of it — the rules are applied by the database, not just the UI.
Private media storage
Story uploads live in a private bucket. Media is served through short-lived signed URLs rather than public links.
Not implemented yet
- End-to-end encryption. Messages are encrypted in transit and at rest, but not end-to-end — we can technically access message contents. Do not treat JLE Gram as a replacement for a dedicated E2EE messenger yet.
- Two-factor authentication and passkeys.
- Device management and remote session revocation.
- Audit logs and compliance certifications (SOC 2, ISO 27001, HIPAA). None have been obtained.
- Independent third-party security audit.
Found a vulnerability? Please report it via our contact page before disclosing it publicly.