Security Architecture

1. Overview

TWINJAM is designed so that it can do its job while holding as little customer content as possible. Messages and ticket descriptions are evaluated in memory and discarded; only flagged excerpts the PM needs as evidence are stored, encrypted, for a bounded period.

This document is the security annex to the Data Processing Addendum. A more detailed version, including our SOC 2 Type II report, is available under NDA from security@twinjam.com.

2. Hosting and data residency

Customer content at rest stays in the selected region. Global services such as billing and transactional email process account data in the United States.

3. Encryption

• At rest: AES-256 for databases, object storage and backups, with a distinct data key per tenant managed in AWS KMS and rotated annually.
• In transit: TLS 1.3 for all external connections, with TLS 1.2 accepted only for legacy webhook senders; HSTS with preload on twinjam.com.
• OAuth tokens for connectors are encrypted with a separate key hierarchy and are never visible to staff.

4. Connector and OAuth model

Each integration uses the narrowest scopes the vendor offers. Slack and Teams connectors only receive events from channels an admin places on the allow-list; events from any other channel are dropped at the connector edge before they reach a processing queue. GitHub access uses a GitHub App with read-only pull request, issue and metadata permissions.

Write access is limited to two cases: posting alerts into the agency's private PM channel, and creating signature envelopes in DocuSign or PandaDoc after a PM approves a change order.

5. Language model processing

Classification and drafting use large language model inference from Anthropic and OpenAI under enterprise agreements with zero data retention: prompts and outputs are not stored by the provider and are not used for training. Inputs are minimised before inference: email addresses, phone numbers and payment details are redacted, and user identities are replaced with tokens.

6. Access control

• Single sign-on with hardware security keys for all staff; no shared accounts.
• Production access through just-in-time grants approved by a second engineer, limited to 4 hours and fully logged.
• Customer workspaces support SAML SSO, SCIM provisioning and role-based permissions (Owner, Admin, PM, Viewer).
• Quarterly access reviews and automatic deprovisioning on departure.

7. Application security

Code changes require peer review and pass static analysis, dependency scanning and secret scanning before merge. Container images are rebuilt weekly from minimal base images. A CREST-accredited firm performs an annual penetration test of the application, connectors and infrastructure; the most recent test concluded in August 2026 with no open critical or high findings.

8. Monitoring and incident response

Infrastructure and application logs flow to a central SIEM with alerting on anomalous access, privilege changes and data egress. Our incident response plan is tested twice a year with tabletop exercises. Customers are notified of personal data breaches within 48 hours, as set out in the DPA.

9. Business continuity

Databases use multi-availability-zone replication with point-in-time recovery. Encrypted backups are taken daily and kept for 35 days in a second region within the same jurisdiction. Recovery objectives: RPO 1 hour, RTO 4 hours. Disaster recovery is tested annually.

10. Compliance

• SOC 2 Type II covering Security, Availability and Confidentiality, examined annually.
• GDPR and UK GDPR, with Standard Contractual Clauses for transfers.
• India's Digital Personal Data Protection Act, 2023, with a Grievance Officer in Mumbai.
• CCPA as amended by the CPRA.
• WCAG 2.2 AA conformance target for the web application.