Security

1.Report a problem

If you think you have found a vulnerability, email privacy@joysts.comwith the subject “Security report”. Include what you found, the steps to reproduce it, and what an attacker could do with it.

• We reply to confirm we have your report.
• We keep you updated while we fix it, and tell you when it is fixed.
• Please do not share the problem publicly until it is fixed.

We do not run a paid bug bounty. The same contact is listed in our security.txt file.

2.Testing guidelines

• Test only against an account you created. Never access another person's data.
• If you reach someone else's data by accident, stop, do not keep or share it, and tell us.
• No denial-of-service, spam, social engineering, or physical attacks.
• Give us a reasonable time to fix the problem before you make it public.

3.What protects your data

• Encryption in transit. Joysts is served only over HTTPS (TLS 1.2 and 1.3), and every database connection requires TLS.
• Encryption at rest. Your files are stored in Cloudflare R2 and your records in Neon Postgres. Both encrypt data at rest with AES-256.
• Row-level security. The web app connects to the database with a role that cannot bypass row-level security, so each query only sees rows for the signed-in account and the home it is working on. Automated tests check this on every change.
• Signed, short-lived file links. Files are never public. Opening a document or photo creates a signed link that expires within an hour (15 minutes for a document), and upload links expire after 5 minutes.
• Passwords are stored hashed, never in plain text.
• No session recording. We do not record or replay your screen.

Section 11 of our privacy policylinks each of these to the provider's own documentation. What each provider keeps, and for how long, is in section 9.

4.Audits and certifications

If an audit is a requirement for you, email privacy@joysts.com and we will answer your questions directly.