Joy Trust Center
Last updated: 8 October 2026 · Everything an office needs to know before it trusts us with documents and data — where they are kept, how they are protected, who processes them and what happens when something goes wrong. No promises without a certificate behind them.
1. Where the data is kept
The cloud database (Supabase) is in the European Union — Ireland. Documents kept in Joy’s store, share links and data rooms are held by Netlify in the United States (US East), with a global delivery network. In local mode the data stays in the browser on your device. An office can also keep a copy in Google Drive, OneDrive or a folder on its own computer. Transfers to the United States rely on the EU–U.S. Data Privacy Framework or on standard contractual clauses, as set out in the Data Processing Addendum.
2. Encryption
All traffic is encrypted (HTTPS only, HSTS for a year including subdomains). The database is encrypted at rest by Supabase. Every signature is signed cryptographically (ECDSA P-256 over a SHA-256 hash), and any change to a signed document is detected. A backup the office downloads is encrypted with a password only the office knows.
3. Backups
The database is backed up daily, with 7 days kept. Documents in Joy’s store are copied every night to a separate backup kept for 14 days. On top of that, every office can download a full encrypted backup of its data and documents at any time, and set a weekly or monthly copy to a folder on its computer.
4. Access and permissions
Every office is isolated in the database by row-level security — one office cannot see another office’s data. Inside the office there are roles and per-user permissions, ethical walls for sensitive matters, a screen lock after 30 minutes without activity and automatic sign-out after 12 hours. AI assistants (Claude, ChatGPT) are given no tools that delete documents, and their connection is cut at once from the connectors page.
5. Privacy and Amendment 13
Joy follows the Israeli Protection of Privacy Law, 5741-1981, including Amendment 13 (in force since August 2025), the Protection of Privacy (Data Security) Regulations, 5777-2017, and the GDPR for customers in Europe. The office is the controller and Neos Tech is the processor, under the Data Processing Addendum. We do not sell the data, do not use it for advertising and do not train models on it. The app has tools to export all data and to delete an account or a whole office, with a deletion certificate.
6. Standards and certification
Joy does not hold an ISO 27001 certificate or a SOC 2 report today, so we do not claim them. What there is: the data-security regulations applied, a Data Processing Addendum under GDPR article 28, an accessibility statement under Israeli Standard 5568, and automated tests on every release. When a certificate exists, it will appear here with the certificate itself.
7. Service providers that process data
Netlify, Inc. — hosting, server functions and document storage (United States). Supabase, Inc. — accounts and the database (Ireland). Anthropic, OpenAI and Google — the AI models, only when AI features are used. Resend — system e-mails such as address confirmation. Google, Microsoft and Dropbox — only when the office connects them itself. A new provider is announced here and in the app at least 30 days in advance.
8. Security incidents
If a security incident affects an office’s personal data, we notify the office without undue delay and within 48 hours of becoming aware of it, with the information we have, and help it meet its own reporting duties (including to the Privacy Protection Authority). Found a security issue? Write to adir@joyworkos.com — the contact is also in our security.txt.
9. Privacy and security contact
Adir Trabelsi, Neos Tech Ltd (company number 515155182), 12 Bar Kochva St., Bnei Brak, Israel · adir@joyworkos.com. More: Security · Privacy Policy · Data Processing Addendum · Terms · Accessibility statement · Open-source licenses.