Security

Jelect is a B2B SaaS product operated by Arenzo. Security is built into how the product is architected, not bolted on. This page describes the controls in place today.

Tenant isolation

Every customer's data lives in a single database, isolated by row-level security (RLS) enforced at the database layer. A row is only ever visible or writable to members of the workspace that owns it — isolation is enforced by the database on every query, not by application code that could be bypassed. Programmatic API access is scoped to the calling key's own workspace and cannot read or modify another customer's data.

Authentication & access

• User sign-in is handled by a managed authentication provider; passwords are never stored by Jelect.
• API keys are generated with a cryptographically secure random source and stored only as a SHA-256 hash — the plaintext key is shown once at creation and never persisted, so it cannot be recovered from our systems.
• Platform-administrative actions (such as loading shared reference data) require a separate operator credential, distinct from customer API keys.
• Per-key rate limiting protects the API from abuse.

Data & hosting

• Application and database are hosted on EU infrastructure (Supabase and Vercel). Data in transit is encrypted with TLS; data at rest is encrypted by the hosting providers.
• Jelect enriches accounts using publicly available information only (firmographics, public company registries, public company news). It does not scrape LinkedIn or other sources that prohibit it.
• No customer data is sent to any large language model. Every "AI" output in Jelect — scores, briefs, conversation starters — is produced deterministically from rule-based logic. There is no LLM in the data path.

Change management & observability

• Database schema and security policies are version-controlled and reviewed as code.
• Automated tests run on every change (including a guard that the scoring engine behaves identically across its implementations).
• Application and error logs are captured for the running service so failures are visible and diagnosable.

Reporting a concern

If you believe you've found a security issue, please contact us at security@jelect.io. We take reports seriously and will respond promptly.