Enterprise-Grade Security
Your data deserves the best protection. AJAIA is built with security-first principles to keep your work items, API keys, and credentials safe.
🔒 We Never Read Your Source Code
AJAIA reads work items, not repositories. It integrates with Azure DevOps and Jira boards - titles, descriptions, states, and comments - and never accesses file contents, diffs, commits, or source code. Your codebase remains completely private.
How We Protect Your Data
Security is not an afterthought. It is built into every layer of AJAIA.
AES-256 Encryption at Rest
Stored credentials are encrypted with AES-256: authenticated AES-256-GCM in the credential vault, and AES-256-CBC with a random IV per operation for integration credentials. The database layer adds provider-managed encryption at rest.
- Scrypt key derivation (memory-hard, brute-force resistant)
- Random IV for every encryption
- Authentication tags on vault entries prevent tampering
- Encryption key health is verified per environment from the admin console
Secure Transit
All data in transit is protected with modern TLS protocols and strict security headers.
- TLS 1.2+ for all connections (TLS 1.3 preferred)
- HTTPS enforced everywhere
- HTTP Strict Transport Security (HSTS)
- Content Security Policy (CSP)
Role-Based Access Control
Fine-grained permissions ensure users only access what they're authorized to see.
- Organization-level isolation, monitored by a runtime tenant-isolation tripwire
- Owner, admin, and member roles - platform controls are restricted to the owner tier
- Secure session management
- Automatic session expiration
Input Validation & Sanitization
User inputs are validated and sanitized to prevent injection attacks.
- SQL injection prevention (fully parameterized queries)
- XSS protection: output escaping and allowlist HTML sanitization
- Prompt-injection screening on AI inputs
- AI guardrail: AJAIA proposes, a human confirms every board write
API Key Security
Your ADO and Jira credentials are stored with the highest level of protection.
- API keys encrypted at rest
- Keys never exposed in logs
- Secure environment variable handling
- Revocable access tokens
1,100+ Automated Tests
Over 1,100 automated tests run in CI on every change, including dedicated security suites.
- Authorization tiers (owner vs delegated admin can never be confused)
- Tenant-isolation tripwire coverage
- Deletion cascade and GDPR export (credentials can never leave in an export)
- Post-deploy smoke tests against the live deployment
Compliance & Standards
AJAIA is built to meet enterprise security requirements.
Secure Infrastructure
Hosted on trusted, enterprise-grade platforms.
Vercel Edge Network
Application hosted on Vercel's global edge network with built-in DDoS protection, automatic HTTPS, and SOC 2 Type II certification.
Neon Serverless Postgres
Database powered by Neon with automatic encryption at rest, point-in-time recovery, and secure connection pooling.
Anthropic Claude AI
AI processing powered by Claude with strict data handling policies. Your data is not used to train AI models.
Security Questions?
We're happy to discuss our security practices in detail.
For vulnerability reports, please email us directly. We take all reports seriously and respond within 24 hours.