Security & privacy
TWINJAM reads what it needs, keeps almost nothing, and never trains on it.
Read-only connectors, admin-chosen channels, in-memory processing and zero-retention AI. Built for agencies that answer to their clients' security teams.
Security posture
- SOC 2 Type IICurrent
- Last penetration testAug 2026
- Open critical findings0
- Model training on customer dataNever
- Non-flagged messages stored0
- Data regionsUS · EU · India
Architecture
How a client message moves through TWINJAM.
Events enter through read-only OAuth, are filtered by your allow-list, evaluated in memory, and either discarded or stored as an encrypted excerpt your PM can act on.
Least privilege
Read-only OAuth scopes, connector by connector.
Write access exists in exactly two places: alerts to your private PM channel, and signature envelopes a PM has approved.
| Connector | Scopes requested | Access | Writes |
|---|---|---|---|
 Slack | channels:history, groups:history (allow-listed channels only), channels:read, users:read | Read | chat:write, only to your private PM alert channel |
 Microsoft Teams | ChannelMessage.Read.Group (resource-specific consent), Team.ReadBasic.All | Read | Adaptive Card alerts to a private PM channel |
 Jira Cloud | read:jira-work, read:jira-user, offline_access | Read | None |
 Linear | read | Read | None |
 GitHub | GitHub App: pull requests, issues, metadata (read). Contents: no access | Read | Optional check run status |
 Harvest | Time entries and projects (read) | Read | None |
 DocuSign | signature, impersonation (envelope creation) | Write | Envelopes created only after PM approval |
Data retention
What is processed, what is stored, and what never is.
The default is to forget. We keep only what a PM needs as evidence, for as long as the project needs it.
| Data | Processed | Stored | Never stored |
|---|---|---|---|
| Signed SOWs and MSAs | Encrypted, until you delete them | Retained as described | |
| Extracted boundary rules | Life of the contract | Retained as described | |
| Non-flagged Slack and Teams messages | Never. One-way hash kept 30 days for de-duplication | Never stored | |
| Flagged message excerpts (max 500 chars) | Encrypted, project life plus 90 days | Retained as described | |
| Jira and Linear ticket descriptions | Never. Titles, status and estimates only | Never stored | |
| GitHub source code | Never. File paths and diff stats only | Never stored | |
| Direct messages and non-selected channels | Never received | Never stored | |
| Model training data | Never. Zero training on customer content | Never stored |
Analytics never include Slack messages, Jira descriptions, client names or SOW text. Full schedule in the Privacy Policy.
Channel allow-listing
Your admin chooses the channels. Everything else is dropped at the door.
TWINJAM only evaluates the shared client channels an admin turns on. Internal channels, company channels and every direct message are discarded at the connector edge, before they reach a queue, a model or a log. Toggle the channels to see what reaches processing.
- Clients never receive an automated message
- Alerts post only to your private PM channel
- Allow-list changes are recorded in the admin audit log
Slack · Monitored channels
Admin only- client-halvorsen-freightShared client channel
- client-mapleview-healthShared client channel
- hfx-app-devInternal delivery channel
- generalCompany channel
- randomCompany channel
- Direct messages and group DMsNever available to TWINJAM
1,760
Events, last hour
316
Processed
1,444
Dropped at edge
Controls and compliance
The commitments behind the architecture.
SOC 2 Type II
Annual examination of Security, Availability and Confidentiality controls. Report shared under NDA.
AES-256 at rest
Per-tenant data keys in AWS KMS, rotated annually. Connector tokens use a separate key hierarchy.
TLS 1.3 in transit
Every external hop, with HSTS preload on twinjam.com.
Zero model training
Customer content never trains, fine-tunes or evaluates any model. Inference runs under zero data retention agreements.
US, EU and India residency
AWS N. Virginia, Frankfurt or Mumbai, with backups in a second region in the same jurisdiction.
GDPR and DPDP Act 2023
DPA with Standard Contractual Clauses, and a Grievance Officer in Mumbai.
Penetration testing
Annual test by a CREST-accredited firm. Latest: August 2026, no open critical or high findings.
Responsible disclosure
Found a vulnerability? We want to hear from you.
- 01ReportEmail security@twinjam.com with steps to reproduce. For sensitive issues, ask for an encrypted channel in your first message and we will set one up.
- 02Acknowledge within 24 hoursA security engineer confirms receipt and gives you a tracking reference.
- 03Triage within 2 business daysWe confirm severity and share a remediation timeline: 7 days for critical, 30 days for high.
- 04Safe harborWe will not pursue legal action for good-faith research that avoids privacy violations, data destruction and service disruption, and that stays within your own test workspace.
- 05RecognitionWith your permission, we credit researchers on our security acknowledgements page once the fix ships.
No. An admin selects the shared client channels to monitor. Events from any other channel, and all direct messages, are dropped at the connector edge before they reach a processing queue.
Never. TWINJAM does not train, fine-tune or evaluate models on customer content. Our inference providers, Anthropic and OpenAI, process requests under zero data retention agreements, and inputs are redacted and minimised first.
Nothing but a one-way hash and timestamp, kept for 30 days to avoid evaluating the same message twice. The message text itself is processed in memory and discarded.
In the region you choose: United States (AWS N. Virginia), European Union (AWS Frankfurt) or India (AWS Mumbai). Backups stay in a second region within the same jurisdiction.
Yes. Email security@twinjam.com and we will share the report and our latest penetration test summary under NDA, usually within one business day.
Email security@twinjam.com or follow the instructions in /.well-known/security.txt. We acknowledge within 24 hours, triage within 2 business days and will not pursue legal action against good-faith research that follows our disclosure policy.
Bring your security questionnaire. We will bring the answers.
Scale plan customers get a security review call, our SOC 2 Type II report and a signed DPA before the trial starts.