Security

We take security seriously

J.O.S.I.E holds business knowledge, customer chats, and now visitor leads. That is not a marketing slogan — it is why production runs 13 security layers before a message is stored, a dashboard action is accepted, or a billing event is trusted.

13 production layers

These are controls that ship in the J.O.S.I.E app today — not a future roadmap. Each one is enforced in code on josie-ai.com.

  1. Layer 01

    Tenant isolation

    Every chat, document, API key, and lead is scoped by tenant. A widget key from one business cannot read another business’s data.

  2. Layer 02

    Hashed API keys

    Widget and server keys are stored as bcrypt hashes. The raw key is shown once at creation and is never written back in plaintext.

  3. Layer 03

    Domain-locked embeds

    Live widget keys can be restricted to your site origins. Requests from an unexpected Origin or Referer are rejected.

  4. Layer 04

    Session ownership

    A client-supplied chat sessionId is trusted only after we prove it belongs to the tenant on the API key. Cross-tenant injection is dropped.

  5. Layer 05

    Field encryption at rest

    Authenticator MFA secrets are stored as AES-256-GCM (enc:v1). A dedicated field key is preferred so rotating the login secret does not orphan MFA.

  6. Layer 06

    Hashed login challenges

    Email OTPs are hashed server-side. The browser only holds a short-lived signed ticket — not the code itself.

  7. Layer 07

    MFA and session versioning

    Tenants can enable TOTP MFA with recovery codes. Password reset and MFA disable bump a session version so older JWTs stop working.

  8. Layer 08

    Same-origin dashboard APIs

    Cookie-authenticated mutations must come from the J.O.S.I.E origin. Cross-site POSTs to dashboard APIs are blocked at the edge.

  9. Layer 09

    Content Security Policy

    Production responses ship a CSP plus hardened headers. This is the same class of finding OWASP ZAP flags when a site has no policy.

  10. Layer 10

    Abuse and rate limits

    Signup, demo keys, and live keys are rate-limited. Production can share counters across processes so limits are not per-instance only.

  11. Layer 11

    Chat guardrails

    Scope, context, and output guards run on the server. Visitors only receive text that has passed the output guard — the same text we persist.

  12. Layer 12

    Signed billing webhooks

    Payment-gateway callbacks require an HMAC signature and a fresh timestamp. J.O.S.I.E never talks to PayMongo or Stripe directly.

  13. Layer 13

    Production fail-closed

    The local IS_DEV login bypass is refused when NODE_ENV is production. A mis-set flag cannot open the dashboard as the demo tenant.

How we encrypt data

In transit

josie-ai.com is served over HTTPS. The production Content-Security-Policy includes upgrade-insecure-requests so mixed-content loads are forced to TLS.

At rest — secrets

MFA authenticator secrets are encrypted with AES-256-GCM before they hit PostgreSQL. API keys and OTPs are hashed (bcrypt / one-way), not encrypted-and-reversible.

What we do not store

Card and GCash credentials never land in this app. Billing goes through the Joe Solutions payment gateway. Knowledge files live in private object storage, keyed per tenant.

How we scan for vulnerabilities

Every pull request and push to the main development branches runs a dependency CVE scan (OSV Scanner, with npm audit as fallback). High and critical findings are printed for AppSec review — we do not treat a green merge as “no vulnerabilities exist.”

We also run OWASP ZAP-style checks against the live site. Recent production work added a Content-Security-Policy and tightened response headers specifically because those scans called out missing browser protections. Findings get fixed in code, then re-checked.

That is continuous scanning, not a one-time badge. If you need a copy of a recent scan summary for due diligence, email support@joesolutions.ph.

Report a vulnerability

If you believe you found a security issue in J.O.S.I.E, we want to hear it before it becomes an incident. Do not post exploit details publicly. Email us directly:

support@joesolutions.ph

Please include:

  • The URL or API path, and whether you used a demo or live widget key
  • What you expected vs what happened
  • Steps to reproduce, and any screenshots or request IDs
  • Your contact details so we can follow up

We will acknowledge responsible reports and keep you updated while we investigate. Do not attempt to access another tenant’s data, and do not run destructive tests against production.

Read our Privacy Policy and Terms of Service. After you sign in, tenant MFA lives under Dashboard → Security.