Security at JaxSuite AI
Cold outreach means handing a platform your mailboxes and your contact data. This page says how both are handled, and stops where the evidence stops.
We do not hold your email password
Connecting a mailbox uses OAuth, which means the product receives a scoped token you can revoke from your own Google or Microsoft account at any time. Nothing about your mailbox is stored as a credential we could lose.
How sending worksScoped tokens, not passwords
Google and Microsoft mailboxes connect over OAuth. The scopes each connection requests are listed on its integration page, so you can see what was granted before granting it.
Revocable from your side
Removing access in your Google or Microsoft account stops sending and reply sync for that mailbox at once. Campaigns using it pause rather than failing silently.
Mail leaves your domain
Campaign email is sent through your own connected mailbox, so it carries your authentication and your reputation rather than a shared relay.
One workspace cannot reach another
Isolation is enforced in the database rather than only in application code, which is the difference between a bug being a bug and a bug being a data leak.
See pricing and plansRow-level security
Workspace rows are protected by database policies, so a query that forgot its workspace filter returns nothing instead of somebody else data.
Multi-factor authentication
Accounts can require a second factor at sign-in, and the verification step is enforced server-side rather than only in the interface.
Rate limiting on public endpoints
Public forms and booking links are rate limited, so a booking page cannot be used to enumerate availability or to flood a calendar.
Third-party assessment
JaxSuite AI has been assessed by an ADA CASA assessor, which is what the ESOF Shield badge in the footer records.
The assessment tier, what it covered and when it was carried out are recorded on the certificate rather than on the badge. We will publish those details here once we can quote them exactly. A security page that rounds a certification up is worse than one that is briefly incomplete, so this section will grow rather than be written from memory.
If you are running a vendor review and need the certificate itself, ask and we will send it.
Security questions we get asked
No. Google Workspace and Microsoft 365 mailboxes are connected over OAuth, so the product holds a revocable access token rather than a password. Revoking access in your Google or Microsoft account stops sending and reply sync immediately, without anything being changed here.
Questions this page did not answer Ask us directly
Vendor reviews, security questionnaires and data processing questions all go to the same place, and a person answers them.