Our Commitment
At Jortel, security is foundational to everything we build. When businesses entrust us with their telephone communications, they are placing their reputation, their customer relationships, and their compliance obligations in our hands. We take that responsibility seriously.
This page provides an overview of the security measures we employ to protect your data, your calls, and your account. If you have specific security questions or requirements, please contact us at security@jortel.com.au.
Infrastructure Security
The Jortelligence platform is built on enterprise-grade infrastructure from trusted providers:
- Application Hosting: Our backend application is hosted on Railway, which provides isolated containers, automated deployments, and infrastructure monitoring;
- Frontend Hosting: Our web application is served via Vercel, which provides a global CDN, DDoS protection, and automatic HTTPS;
- Database and Storage: All application data and file storage is managed by Supabase, built on PostgreSQL, with SOC 2 Type II compliance;
- Telephony: Voice communications are routed through Twilio, a globally recognised communications platform with SOC 2 and ISO 27001 certifications.
We select infrastructure providers that maintain rigorous security certifications and undergo independent third-party audits.
Data Encryption
All data is encrypted both at rest and in transit:
- At Rest: All stored data, including call recordings, transcripts, and account information, is encrypted using AES-256 encryption;
- In Transit: All communications between your browser and our servers, and between our servers and third-party services, are encrypted using TLS 1.2 or higher. We enforce HTTPS on all endpoints with no fallback to unencrypted connections.
Authentication and Access
We implement multiple layers of authentication security:
- Password Security: All passwords are hashed using bcrypt with appropriate salt rounds. We never store passwords in plaintext;
- Session Management: Authenticated sessions are managed via secure, signed JWT tokens with defined expiration periods;
- Rate Limiting: Authentication endpoints are rate-limited to prevent brute-force attacks and credential stuffing;
- OAuth Integration: We support Google OAuth for secure, passwordless sign-in.
Multi-Tenant Isolation
Jortel is a multi-tenant platform serving many businesses. We maintain strict isolation between tenants:
- Row-Level Security: Database queries are scoped to your account at the data layer, ensuring your data is never accessible to other users;
- API Key Scoping: All API operations are authenticated and authorised against your account;
- Live Call Isolation: Real-time call monitoring and event broadcasts are scoped to your account. You can only observe calls belonging to your account;
- Storage Isolation: Call recordings and uploaded files are stored in account-scoped paths with access controls enforced at the storage layer.
Call Security
Given the sensitive nature of telephone communications, we apply specific security measures to call handling:
- Encrypted Recordings: Call recordings are encrypted at rest in Supabase Storage;
- Signed URLs: Access to call recordings is provided via time-limited signed URLs that expire after a defined period. Recordings cannot be accessed via direct or permanent links;
- Webhook Validation: Inbound webhooks from Twilio are cryptographically validated using Twilio's RequestValidator to ensure authenticity and prevent spoofed requests;
- Audio Stream Security: Audio streams between our servers and telephony/AI providers are transmitted over encrypted connections.
Payment Security
All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. Jortel does not store, process, or have access to your full credit card numbers or payment card data. Card information is entered directly into Stripe's secure payment forms (Stripe Elements) and is transmitted directly to Stripe's servers.
Stripe's PCI DSS compliance is independently audited and certified. For more information, visit the Stripe Security page.
Application Security
We follow secure development practices across our engineering team:
- Input Validation: All user inputs are validated and sanitised to prevent injection attacks;
- Dependency Management: Third-party dependencies are regularly reviewed and updated to address known vulnerabilities;
- Error Handling: Error responses are designed to prevent information leakage. Detailed error information is logged internally but not exposed to end users;
- Circuit Breakers: External service integrations are protected by circuit breaker patterns to prevent cascade failures and ensure graceful degradation.
Vulnerability Reporting
We take security vulnerabilities seriously. If you discover a security vulnerability in the J-Voice platform, we encourage you to report it to us responsibly.
Please send your report to security@jortel.com.au with:
- A description of the vulnerability and its potential impact;
- Steps to reproduce the issue;
- Any relevant screenshots, logs, or proof-of-concept code.
We will acknowledge your report within two (2) business days and will work to investigate and address verified vulnerabilities promptly. We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it.
Compliance
Jortel is committed to compliance with applicable Australian laws and regulations, including:
- Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) — governing the collection, use, storage, and disclosure of personal information;
- Do Not Call Register Act 2006 (Cth) — governing restrictions on unsolicited telemarketing calls;
- Telecommunications Act 1997 (Cth) — governing telecommunications services and obligations;
- Spam Act 2003 (Cth) — governing the sending of unsolicited commercial electronic messages;
- Competition and Consumer Act 2010 (Cth), including the Australian Consumer Law — governing consumer protections.
For detailed information about how we handle personal information, please refer to our Privacy Policy.