What actually protects your data
Security pages usually list aspirations. This one separates what is implemented today from what is not.
In place today
Encrypted in transit
All traffic between your device and our servers runs over TLS. Nothing is sent in plain text over the network.
Encrypted at rest
Your messages, profiles and uploads are stored on managed infrastructure with disk-level encryption.
Row-level access control
Every table enforces per-row policies. You can only read a conversation, message or membership row if you are a member of it — the rules are applied by the database, not just the UI.
Private media storage
Story uploads live in a private bucket. Media is served through short-lived signed URLs rather than public links.
Two-factor authentication
Turn on an authenticator app (Google Authenticator, 1Password, Authy) in Settings, with one-time backup codes if you lose your phone.
Devices & session revocation
See each signed-in browser with its approximate location and last activity, and end any of them — the session is killed on our servers, even if that device is offline. Changing your password signs out every other device.
New-device sign-in alerts
When your account signs in from a browser it hasn't used before, you get an in-app alert with the device and approximate location.
Brute-force lockout
Repeated failed sign-ins lock that account for 15 minutes, and sign-up and password-reset requests are rate limited per email and network.
Not implemented yet
- End-to-end encryption. Messages are encrypted in transit and at rest, but not end-to-end — we can technically access message contents. Do not treat JLE Gram as a replacement for a dedicated E2EE messenger yet.
- Passkeys (WebAuthn sign-in).
- New-device alerts by email (alerts are in-app only today).
- Audit logs and compliance certifications (SOC 2, ISO 27001, HIPAA). None have been obtained.
- Independent third-party security audit.
Found a vulnerability? Please report it via our contact page before disclosing it publicly.