DRAFT PLACEHOLDER — NOT A POLICY

This page is scaffolding. It has not been drafted or reviewed by a lawyer, it is not in force, and it must not be relied upon by anyone. It exists so this link resolves while a real policy is prepared. Nothing here is a commitment, a representation of compliance, or a statement of your rights.

JURISGPT · SECURITY

Security

This page lists controls that are present in the code today. It is not a security assurance, and no independent audit, penetration test or certification is claimed here.

Controls present in the code

  • JurisGPT manages password authentication and revocable server-tracked sessions. Session credentials stay in host-only HttpOnly cookies, and private API requests are checked against their account before being forwarded.
  • State-changing browser requests through the frontend are checked for their origin, Fetch Metadata and a required application header. Authenticated API calls are forwarded by the server using the credential in the HttpOnly cookie.
  • Rate limiting middleware runs across the API, and the public demo route adds a per-IP limit of its own.
  • Cross-origin access is restricted to an explicit allowlist configured through an environment variable.
  • Every frontend response carries Content-Security-Policy, Strict-Transport-Security, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy and Permissions-Policy headers.
  • The in-memory request audit log redacts values that look like API keys or service credentials.

What this page does not say

It makes no claim about encryption specifics, key management, backups, staff access, or the security posture of any third-party service this product depends on. Those need to be established and verified before they can be described.

NOT DECIDED OR DOCUMENTED YET

Deliberately left blank rather than filled with plausible-sounding text. Each item needs a decision and legal review before it can appear here.

  • Encryption at rest and in transit, stated precisely and verifiably
  • Key management and secret rotation
  • Backup, restore and disaster recovery
  • A vulnerability disclosure route and expected response times
  • Incident detection, response and customer notification
  • Internal access control and least-privilege review
  • Security review of sub-processors