# Jithox — security and procurement answers A filled-in standard vendor questionnaire (the questions a procurement or security team usually asks, in the order of a short CAIQ-style form). Every answer is what is true today. Where something does not exist, the answer says **No**, and it does not say "planned" unless a date exists. **Version:** 23-09-2026. Not legal advice. Not reviewed by an auditor. Where this file and the data processing agreement (https://jithox.com/dpa) differ, the agreement applies. **Questions not answered here:** mail info.jithox@gmail.com with subject "Procurement". A person reads every message. There is no guaranteed response time. --- ## 1. Company | # | Question | Answer | | --- | --- | --- | | 1.1 | Legal entity | Victor-Emmanuel Charlier, trading as Jithox. Sole trader (natural person), Belgium. | | 1.2 | Company and VAT number | KBO/BCE 1039.898.594, VAT BE1039898594. | | 1.3 | Registered address | Not published on the website. Given on request, and in a signed data processing agreement. | | 1.4 | Number of people | One. The owner builds and operates the service. | | 1.5 | Data protection officer | No. None has been appointed. | | 1.6 | Security contact | info.jithox@gmail.com, published in https://jithox.com/.well-known/security.txt (RFC 9116). | | 1.7 | Customer references | None are published. | ## 2. Certifications and independent testing | # | Question | Answer | | --- | --- | --- | | 2.1 | ISO 27001 | No. | | 2.2 | SOC 2 (Type 1 or 2) | No. | | 2.3 | Other certifications (HIPAA, PCI DSS, BSI C5, …) | No. Card data never reaches Jithox: card payment runs on Stripe's hosted checkout. The USDC rail in 9.2 carries no card data. | | 2.4 | Independent penetration test | No. None has taken place. Our own tests are not an independent penetration test. | | 2.5 | Bug bounty | No. Reports are welcome at the security contact; no reward is promised. | | 2.6 | Cyber or professional liability insurance | No proof of insurance is offered. | ## 3. Hosting and data location | # | Question | Answer | | --- | --- | --- | | 3.1 | Website, API and application | Vercel, region `fra1` (Frankfurt, Germany). Configured in `vercel.json` and visible in the live `X-Vercel-Id` response header. | | 3.2 | Database | Neon Postgres, region `eu-central-1` (Frankfurt, Germany). | | 3.3 | MCP servers on mcp.jithox.com | Hetzner, Helsinki (Finland). | | 3.4 | Sub-processors | The full list, with what each does, when it is engaged and where it processes, is Annex IV of the data processing agreement: https://jithox.com/dpa. It is also shown on https://jithox.com/enterprise. Some are outside the EU (for example Clerk and Resend in the United States). | | 3.5 | Notice of a new sub-processor | 14 days in advance, via the /dpa page (DPA Clause 7.7(a), option 2). | | 3.6 | Own data centres | No. | ## 4. Data protection | # | Question | Answer | | --- | --- | --- | | 4.1 | Data processing agreement | Yes: the EU Standard Contractual Clauses 2021/915 with filled-in annexes, https://jithox.com/dpa (PDF and Markdown). Signed on request. | | 4.2 | What personal data is processed | Per service, in DPA Annex II. | | 4.3 | Is customer data used to train AI models | No. The code has no model training or fine-tuning call. Some tools send the submitted content to a model provider: OpenAI, Anthropic or DeepSeek (DPA Annex IV, rows 7 to 9), each only when that provider is configured. That provider's own API terms apply. DeepSeek processes in the People's Republic of China. | | 4.4 | Data retention | It depends on the kind of data. Site analytics events: an hourly scheduled job deletes them after 30 days. Records of calls to tools that do not exist: the same job deletes them after 90 days. That job only deletes when a separate maintenance database connection is configured; whether it is configured in production has not been measured, so whether these deletions run today is unknown. Images uploaded to a workspace: they expire after 90 days and are deleted at the next upload in that workspace. Quotes, invoices, approvals, receipts and account data: no automatic deletion; a person deletes them on request (DPA Annex II, "Duration"). | | 4.5 | Deletion on request | Yes, by a person, per request type: https://jithox.com/data-deletion. There is no guaranteed turnaround. | | 4.6 | Export and portability at the end of the contract | No self-service export. Data is provided by hand on request. After termination the customer chooses deletion or return (DPA Clause 10(d)). | | 4.7 | Data minimisation | Invoice Status removes contact names, e-mail, phone, address and free reference text before it returns a result. Public site analytics carry no personal fields (https://jithox.com/privacy). | ## 5. Technical security measures | # | Question | Answer | | --- | --- | --- | | 5.1 | Encryption in transit | Yes. HTTPS only; `Strict-Transport-Security: max-age=63072000; includeSubDomains`. | | 5.2 | Encryption at rest | Third-party credentials a customer connects are encrypted with AES-256-GCM before storage; the service refuses to store them unencrypted. Disk-level encryption of the database is the database provider's; Jithox has not verified it for this answer. | | 5.3 | Storage of API keys | Only as a SHA-256 hash, never in raw form. | | 5.4 | Separation between customers | Postgres row-level security with `FORCE ROW LEVEL SECURITY` on tenant tables. | | 5.5 | Security headers | `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, `Referrer-Policy`, `Permissions-Policy`. The Content-Security-Policy runs in **report-only** mode: it is not enforced yet. | | 5.6 | Customer sign-in | Through Clerk. Jithox's own code does not require multi-factor sign-in; whether the sign-in provider's settings require it is not documented here. | | 5.7 | Machine access | OAuth 2.1 tokens with per-tool scopes on mcp.jithox.com; hashed API keys; connections a person approves and can revoke. | | 5.8 | Actions with side effects | Only after an explicit human approval bound to the exact content, executed at most once, with an append-only receipt. Receipts from the MCP servers are signed with Ed25519 and can be verified offline: https://jithox.com/trust. | | 5.9 | Access to production data | One person, the owner. Whether multi-factor sign-in is enforced on every administrative account: not documented. | | 5.10 | Logging | Approvals, dispatch attempts, receipts and billing entries are stored append-only. No customer content and no secrets in audit records. There is no SIEM. | | 5.11 | Dependency and vulnerability management | A written dependency update policy (critical and reachable: blocked immediately). A CI workflow runs a typecheck, tests and a production build. No branch protection enforces it, and a merge can land without it. There is no automated dependency-audit or secret-scanning step. | ## 6. Availability and continuity | # | Question | Answer | | --- | --- | --- | | 6.1 | SLA | No. There is no financial SLA. | | 6.2 | Uptime figure | No. Uptime is not measured, so no number is published. | | 6.3 | Status page | Yes: https://jithox.com/status, derived from live configuration. It shows current availability, not incident history. | | 6.4 | Behaviour during an outage of a source | The server answers a typed "unavailable"; nothing is executed or charged. | | 6.5 | Backups | The database uses the provider's managed point-in-time restore. The retention window of our plan is not stated here. A recovery rehearsal was done as a tabletop exercise; there is no audited backup or restore procedure. | | 6.6 | Business continuity with one person | There is no deputy. If the owner is unavailable, nobody else can operate the service. | | 6.7 | 24/7 on-call | No. | ## 7. Incidents | # | Question | Answer | | --- | --- | --- | | 7.1 | How do we report an incident or vulnerability | info.jithox@gmail.com (security.txt). Leave exploit details of live customer data out of the first message. | | 7.2 | Breach notification to the customer | Under DPA Clause 9.2: without undue delay after Jithox becomes aware of it, to the contact the customer gave in Annex I. No fixed number of hours is promised. | | 7.3 | Internal incident register | Yes, append-only, with masked account references. | | 7.4 | Public incident history | No. | ## 8. Support | # | Question | Answer | | --- | --- | --- | | 8.1 | Channel | One mailbox, info.jithox@gmail.com. A person reads every message. | | 8.2 | Guaranteed response time | No. | | 8.3 | Languages | English and Dutch. | | 8.4 | Named account manager | No. | ## 9. Commercial | # | Question | Answer | | --- | --- | --- | | 9.1 | Pricing | A fixed price per accepted call, bought in advance: https://jithox.com/mcp/pricing. No subscription, no automatic renewal, no overage. | | 9.2 | Payment | Card through Stripe's hosted checkout. A billing address is required and the company VAT number can be entered; Stripe calculates the VAT on credit top-ups. Separately, four MCP products (E-Invoice, Import, Energy, Sanctions) can be paid per call in USDC over x402, without an account; that rail is a published canary reference (https://mcp.jithox.com/x402/products), not the checkout this questionnaire describes. | | 9.3 | Invoice in the company's name | A one-off top-up does not create an invoice at checkout today. | | 9.4 | Payment by bank transfer or purchase order | Not offered in the checkout. | | 9.5 | Terms | Plain-language terms, not reviewed by a lawyer: https://jithox.com/terms. | | 9.6 | Liability | The service is provided as-is, without warranties. No liability cap is published. | | 9.7 | Governing law and courts | Not published. | | 9.8 | Custom contract, our paper | On request. Every change beyond the published terms and the DPA is a decision by the owner. |