For procurement and security review
What your procurement or security team will ask before a larger contract, answered as it is today. Jithox is run by one person. Where the answer is no, this page says no.
The usual questions
| Topic | Status | Answer |
|---|---|---|
| Security questionnaire | Yes | A filled-in standard questionnaire, including every question where the answer is no. |
| Data processing agreement | Yes | The EU Standard Contractual Clauses 2021/915 with filled-in annexes. Signed on request. |
| Sub-processor list | Yes | Below on this page, identical to Annex IV of the agreement. 14 days' notice of a new one. |
| Hosting and data location | Yes | Application in Frankfurt (Vercel fra1), database in Frankfurt (Neon eu-central-1), MCP servers in Helsinki (Hetzner). Some sub-processors process outside the EU; the list says which. |
| Status page | Partly | Current availability per server. No incident history. |
| Uptime SLA | No | No financial SLA and no uptime figure: uptime is not measured, so no number is published. |
| Incident process | Partly | A published security contact (security.txt) and breach notification without undue delay under the agreement. No fixed number of hours and no on-call rota. |
| Support and response time | Partly | One mailbox, and a person reads every message. No guaranteed response time. |
| Invoice in your company's name, with VAT | Yes | Your billing address and VAT number are taken at checkout, and Stripe creates an invoice after payment. |
| Contract terms | Partly | Plain-language terms, not reviewed by a lawyer. Governing law and courts are not stated. |
| Liability | No | The service is provided as-is, without warranties. No liability cap is published. |
| Exit and data portability | Partly | At the end of the contract you choose deletion or return (agreement Clause 10(d)). There is no self-service export: data is provided by hand. |
| Independent penetration test | No | None has taken place. Our own tests are not an independent penetration test. |
| ISO 27001 or SOC 2 | No | We hold no ISO 27001, no SOC 2 and no other certification. |
| Cyber or liability insurance | No | No proof of insurance is offered. |
Security questionnaire
About 60 standard questions, answered in one file: company, certifications, data location, data protection, technical measures, availability, incidents, support and commercial terms. Attach it to your vendor review, or send us your own form.
Sub-processors
This is Annex IV of our data processing agreement, shown here as it stands in the agreement. Where the agreement and this page could differ, they cannot: the table is read from the agreement's file.
| # | Sub-processor | What it does for Jithox | Engaged | Where (as published by the sub-processor) | Its own DPA / sub-processor list | Source in code |
|---|---|---|---|---|---|---|
| 1 | Vercel Inc. | Website/API hosting, runtime logs and Web Analytics | Hosting; Analytics through the configured client/server paths | Compute configured fra1; actual log and Analytics storage regions UNKNOWN | https://vercel.com/legal/dpa | vercel.json:8; src/features/site-analytics/track-funnel.ts:78-105 |
| 2 | Neon | Configured Postgres stores for application records and enabled event writers, not all copies of all data | Database-backed paths; anonymous/free public MCP telemetry skips its DB writer | Current region and backup/PITR retention UNKNOWN in B1 | https://neon.com/dpa (redirects to platform terms §3.4) | src/lib/db.ts:22-44; src/app/api/mcp/route.ts:319-332 |
| 3 | Hetzner Online GmbH | Servers of the MCP fleet on mcp.jithox.com | Always | Helsinki, Finland (measured: AS24940) | https://www.hetzner.com/AV/DPA_en.pdf | docs/website/ZAKELIJK_AFNEMEN.md:24 |
| 4 | Clerk, Inc. | Sign-in: e-mail, name, session | Always | United States, per Clerk's own DPA (account data is processed under the EU-U.S. Data Privacy Framework; Clerk's Trust Center sub-processor list is at clerk.com/legal/subprocessors, current as of 10-07-2026) | https://clerk.com/legal/dpa | package.json (@clerk/nextjs); src/features/auth/clerk.ts |
| 5 | Stripe | Card payment and checkout: buyer name, e-mail, billing address, VAT id | Always (paid orders) | Ireland (Stripe Payments Europe, Ltd., contracting entity for a non-US account) and United States (Stripe, Inc., operational replication for fraud prevention), per Stripe's own DPA §1 and §3.2 | https://stripe.com/legal/dpa | package.json (stripe) |
| 6 | Resend | E-mail addresses/content for sending and inbound handling | When the relevant mail feature and credentials/sender are configured; not a default recipient of the eight public checks | Historical published location: United States; actual current account configuration and retention UNKNOWN | https://resend.com/legal/dpa | src/features/mcp-email/client/email-client.ts:160-234; src/features/workspace/inbound-email-body.ts:21 |
| 7 | OpenAI | Separate drafting/image/audio features, not an internal model call in the current eight public check adapters | Feature and key dependent; image/audio plugins use a configured environment key and are retired from /api/mcp. It is not established that every key belongs to the customer | Actual request processing location and retention UNKNOWN; the historically consulted provider list names multiple countries | Signed agreement on file UNKNOWN; historical provider list: https://platform.openai.com/subprocessors | src/features/hosted-draft-beta/hosted-openai-draft-transport.ts:25; src/features/mcp-plugins/plugins/receipt-vision-plugin.ts:187-189; src/features/release/retired-tools.ts:26-27 |
| 8 | Anthropic | Only in C: drafting with a model key the customer brings | Only when the controller configures an Anthropic model key | Worldwide, per Anthropic's own sub-processor list (trust.anthropic.com/subprocessors, checked 23-09-2026: AWS and Google Cloud, the underlying infrastructure for all products, are both listed with country "Worldwide", not a specific country) | https://www.anthropic.com/legal/data-processing-addendum | src/features/model-engine/model-engine.ts:67 |
| 9 | DeepSeek | Only in C: fallback model for drafting | Only if the DeepSeek fallback is configured (owner does not use it today, see PRODUCT memory) | People's Republic of China, as stated in DeepSeek's own privacy policy (cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html, "Data storage": "we directly collect, process and store your Personal Data in People's Republic of China") | ONBEKEND — DeepSeek publishes a privacy policy, not a GDPR-standard DPA or SCC package; no EU adequacy decision covers China | src/features/ai-gateway/config.ts:47; src/features/ai/deepseek.ts:25 |
| 10 | Upstash (Redis) | Rate limiting and duplicate detection | Only if configured (Upstash env vars set for the deployment) | Selectable AWS region at database-creation time (Upstash documents both EU options, e.g. eu-west-1 Ireland and eu-central-1 Frankfurt, and US options); which region the current database uses is ONBEKEND, eigenaar controleren | https://upstash.com/static/trust/dpa.pdf (sub-processor list at upstash.com/static/trust/subprocessors.pdf) | src/features/security/rate-limit-store.ts:149-150; src/features/agent-preflight/dedupe-store.ts:62-63 |
| 11 | Vercel Blob | Workspace media bytes | Only through a configured media-storage path; not automatically every image/audio tool | Blob region and physical deletion/backups UNKNOWN; not inferred from compute region | https://vercel.com/legal/dpa | src/features/media-assets/store.ts:24-72; src/app/api/workspace/media/route.ts:52-67 |
| 12 | Google Cloud Tasks | Queue for agent actions | Only if enabled (the owner does not use this today) | Region is a per-project GCP configuration choice; Google's Cloud DPA (cloud.google.com/terms/data-processing-addendum §10) states data may be processed in any country where Google or its sub-processors maintain facilities unless a region is pinned; which region Jithox would pin is ONBEKEND, eigenaar controleren (not configured) | https://cloud.google.com/terms/data-processing-addendum | src/features/agent-actions/google-cloud-tasks-agent-action-dispatch-queue.ts:247 |
| 13 | Sentry (not an active recipient in this adapter) | Error-monitoring placeholder | Adapter is not installed; setting a DSN alone does not send an event | Not established; current adapter logs to console instead | https://sentry.io/legal/dpa/ | src/features/monitoring/error-monitoring.ts:59-60,102-117 |
| 14 | Telegram | Notification that a draft is ready | Only if configured (the owner does not use this today) | For EEA/UK sign-ups Telegram states its data centres are in the Netherlands (telegram.org/privacy §"Where do we store your data"); a bot's outbound message to an existing chat runs over the same Telegram infrastructure | https://telegram.org/privacy (no separate GDPR sub-processor DPA is published for the Bot API; the Standard Bot Privacy Policy at telegram.org/privacy-tpa applies to bots without their own policy) | src/features/workspace/draft-ready-notifier.ts:83 |
| 15 | Payhip | Sale and delivery of Jithox downloads (withdrawn from sale on 2026-09-18; existing buyers keep access); sends Jithox a webhook with buyer data, of which Jithox stores the buyer e-mail only as a SHA-256 hash | Only for existing buyers of the withdrawn product; no new sales | EU, per Payhip's own privacy policy (payhip.com/privacy, "Where we store your personal data": "All information We hold about you is stored on secure servers in the EU"); the data controller, Payhip Limited, is registered in London, UK, but that is the controller's registered office, not the stated storage location | ONBEKEND — Payhip publishes a privacy policy, not a standalone GDPR DPA; no separate sub-processor list found | src/content/site/offers.ts:158-159,166; src/app/api/webhooks/payhip/route.ts:69 |
Contact for procurement
One address. Put "Procurement" in the subject, and a person reads it.
- Your company and what you want to use Jithox for.
- Your own questionnaire or contract, if you have one.
- Whether you need a signed copy of the data processing agreement.
There is no guaranteed response time, and any change to our terms is decided by the owner.