The security and privacy of Customer Data matter to us. This Annex describes the technical and organizational measures Jarvis implements to secure the Platform and protect Customer Data, as a holder (מחזיק) under the Protection of Privacy (Data Security) Regulations, 2017, at the medium security level. Jarvis may replace any measure with a materially equivalent alternative that provides a substantially similar level of security. This Annex is governed by the Data Processing Addendum, and terms defined there have the same meaning here.
1.1 Systems and locations. The application, database, and document storage run on cloud infrastructure in data centers located in Israel. AI analysis is performed by a third-party AI provider through a global service, which may process data outside Israel. The providers and their locations are listed in the Sub-processor list. Jarvis keeps an up-to-date inventory and diagram of these systems.
1.2 No training on Customer Data. Customer Data is not used to train AI models, by Jarvis or by its AI providers, except with Customer's prior written consent for models private to Customer.
1.3 Retention. Customer Data is kept only for as long as the service needs it and is deleted after termination as set out in the DPA. Documents are sent to the AI provider using stateless requests; Jarvis does not store conversations with the provider, and the provider's optional response caching is turned off. The provider's abuse-monitoring logging remains active, as described in Section 5 of the DPA.
1.4 Encryption. Data in transit is encrypted using TLS 1.2 or higher. Data at rest, including the database, document storage, and backups, is encrypted using AES-256.
1.5 Authentication. Each User signs in with personal credentials, and credentials must not be shared.
1.6 Customer systems isolation. Jarvis is not given access to Customer's systems. The Platform does not interact with Customer's systems unless Customer enables an integration.
1.7 Data segregation. The Platform runs on secure multi-tenant infrastructure with logical segregation of each customer's data. Segregation does not apply to direct communication channels such as email or support requests, which is why Customer Personal Data must not be sent through them.
1.8 Network. Access to the database is restricted by network rules to the Platform's own services. Outbound connections from production systems are limited to permitted services, such as the AI provider.
1.9 Logging. The Platform collects access and security logs, which are reviewed routinely and kept for at least 24 months.
1.10 Backups. The database is backed up automatically every day, and backups are kept for 30 days. Storage that held Customer Data is erased before it is released.
1.11 Physical security. Jarvis operates no data center of its own. Physical and environmental security is provided by the cloud providers above, which hold ISO 27001, ISO 27017, ISO 27018, and SOC 2 attestations.
2.1 Responsibility. Jarvis names a person responsible for information security and data protection, reachable at michael@jarvis-agents.com.
2.2 Security procedure. Jarvis maintains a written internal security procedure that implements this Annex, including the topics required by the Data Security Regulations, and reviews it at least once a year.
2.3 Personnel. Every person with access to production systems or Customer Data is screened before access is granted, has signed a confidentiality undertaking, reviews and approves the security procedure, and receives data-security training before access and at least every two years.
2.4 Access management. Access to production systems is limited to authorized personnel, follows least privilege, is granted by role on a need-to-know basis, is recorded in a current permissions list, and is revoked immediately when a person's role ends.
2.5 Endpoint security. Computers with access to production resources run approved endpoint-security software, comply with Jarvis's password policy, lock automatically when inactive, and are physically secured when not in use. Portable storage devices are not used for Customer Data.
2.6 Production separation. Production systems are separated from development and test systems, and Customer Data is not used in development or testing.
2.7 Patching. Systems are kept up to date with security patches.
2.8 Security records. Jarvis keeps a record of critical security information, including production access permissions, security incidents, and audits, for at least 24 months.
2.9 Incidents. Jarvis records every security incident, responds according to a written procedure, reviews incidents at least once a year, and notifies Customer as set out in the DPA.
2.10 Business continuity. Jarvis maintains a business-continuity plan listing key continuity risks and their mitigations.
2.11 Audits. Jarvis carries out an internal or external audit of its compliance with this Annex at least once every 24 months. Jarvis does not currently hold its own ISO 27001 or ISO/IEC 42001 certification.