You trust Ajonic with your briefs, brand, designs and business information. Here is exactly what we do to protect it today. Security is shared: we secure the platform, and you keep your password safe and decide who joins your workspace.
1. How we protect your data
- Encryption in transit. All traffic to ajonic.com uses HTTPS (TLS).
- Encryption at rest. Our database (MongoDB Atlas) encrypts stored data. API keys saved in the app are additionally encrypted with AES-256-GCM and never shown again after saving.
- Passwords and sessions. Passwords are stored only as salted bcrypt hashes. Sessions are checked on the server, end when you sign out and can be revoked; removing a team member ends their sessions.
- Workspace isolation. Every project, task and file belongs to one workspace, and the server checks the workspace and your membership on every request.
- Roles and permissions. Owner, admin, manager, employee, client and viewer roles are enforced on the server for every action, including billing and automations.
- Abuse protection. Sign-in, sign-up and password reset are rate-limited. When the AI reads a website, requests are blocked from reaching private networks.
- Spending limits. Every task, retry and automation is checked against your plan’s credits before it runs, and automations have run and budget limits.
- Audit logs. Important actions such as role changes, billing changes and key updates are logged.
- Payments. Card details are handled by Paddle. We never see or store full card numbers.
- Secrets. Provider keys are kept on the server only, never in the website code sent to browsers.
2. AI providers and connected services
To run a task, the prompts and content it needs are sent to our AI and search providers (listed in our Privacy Policy), which process them only to return a result. Please do not put passwords, card numbers or health records into briefs or chats.
3. What we do not claim
We are a young company and we are honest about it: Ajonic does not hold SOC 2, ISO 27001 or HIPAA certification and has not completed an independent security audit. Two-factor sign-in is not available yet. If you need a security questionnaire answered, email contact@ajonic.com.
4. Reporting a vulnerability
If you find a security problem, email contact@ajonic.com with the subject “Security”, a description, the steps to reproduce it and any evidence. We acknowledge reports within 2 business days and keep you updated until it is fixed. Please do not access other people’s accounts or data, run denial-of-service tests, or share the issue publicly before we have fixed it. We do not run a paid bug bounty programme.
5. Incidents
If a security incident affects your data, we will tell affected account owners without undue delay and notify authorities where the law requires.
6. Contact
Ajonic
Ground floor, near Royal Furniture House, Ladwa, Kurukshetra, Haryana, India
Email: contact@ajonic.com
Phone: +91 87280 72560