# Security

> How sign-in, sessions and data are protected, and how to report a security problem.

Source: https://docs.jambu.si/trust/security/

# Security

## Sign-in

Sign-in is done on the Jambavanta account service, not inside Jambu. Jambu never sees your password.

## Sessions

- Your session uses short-lived access tokens that renew while you use the app.
- The long-lived credential is kept in a cookie that scripts on the page cannot read.
- You can see your devices and end any session from your account page.

## Data

Data is stored in managed databases, separate for each part of the product. Connections are encrypted in transit.

## What we ask of you

- Keep your device secure.
- Do not share sign-in codes with anyone, including an AI assistant.
- Sign out of shared devices.

## Report a problem

Write to support@jambavanta.com with "Security" in the subject. See also `/.well-known/security.txt`. Please give us reasonable time to fix a problem before sharing it.