Security and data protection

Where your data lives

Joy runs in your browser. In local mode, your account and work data are kept in the browser on your device. Documents you save to the Joy store, share links and data rooms are stored on our hosting provider’s servers (Netlify), separated per workspace. The cloud database (Supabase) is in the European Union — Ireland, with daily backups. Documents saved to the Joy store, share links and data rooms are held by Netlify in the United States (US East), with a global delivery network — as set out in the data processing agreement.

Encryption in transit

All traffic uses HTTPS only (TLS 1.2 or later), with HSTS for one year including subdomains. The service is never reachable over an unencrypted connection.

Encryption at rest

Documents, share links, data rooms, signing processes and questionnaires stored on Netlify’s servers are encrypted at rest with AES-256, and so is cloud account sync (Supabase) — per the security pages of Netlify and Supabase. Local-mode data stays in the browser on your device; your computer’s disk encryption (FileVault on Mac, BitLocker on Windows) protects it, and we recommend turning it on.

Application protections

A Content Security Policy that allows only predefined sources, protection against embedding in other sites, no MIME-type sniffing, and minimal browser permissions — no camera or location; the microphone only for Joy’s own voice typing, when you allow it.

Document sharing

Share links expire on the date you choose, can be password-protected, and keep an access log per link.

Digital signatures

Every signature is sealed cryptographically (ECDSA P-256 over a SHA-256 hash of the document). Any change after signing is detected on verification, and every process keeps a completion certificate.

Connecting Claude and ChatGPT

The connection uses OAuth 2.1 with PKCE. Access tokens last one hour, refresh tokens rotate on every use, and you can disconnect at any time in Connectors — revocation is immediate. AI assistants are given no tools that delete documents.

Cloud storage connections

Google Drive, OneDrive / Microsoft 365 and Dropbox connect only when you ask. Files are imported only when you pick them, and access tokens stay in your browser.

AI features

When you use Joy’s AI features, the text you send is processed by the AI provider behind that feature (Anthropic, OpenAI or Google) to produce the answer.

Service providers

Netlify — hosting, serverless functions and file storage. Supabase — cloud account sync, when enabled. AI providers — only when AI features are used. Google, Microsoft and Dropbox — only when you connect them.

Private preview

The app is invite-only right now. Every sign-in requires a personal invite code.

Reporting a vulnerability

Found a security issue? Write to adir@joyworkos.com. Contact details are also in our security.txt.

Everything in one place: the Joy Trust Center.

Last updated: 8 October 2026