How Jorg AI protects your data

Jorg AI is built security-first with multiple layers of protection.

Password security:

• Securely hashed using industry-standard algorithms. Never stored in plaintext
• Minimum 10 characters with uppercase, lowercase, digit, and special character
• Password changes invalidate existing sessions

Alpaca API key encryption:

• Encrypted at rest using industry-standard encryption
• Decrypted only in memory when executing trades
• Never logged, never returned in any API response
• Encryption key stored in environment variables, never in database

Authentication:

• JWT access tokens (30-minute expiry) for session management
• Refresh tokens (30-day expiry) for seamless re-authentication
• Automatic token refresh with retry on expired sessions

Audit logging:

Every sensitive action is logged with timestamp and IP address:

• Login attempts (success and failure)
• Trade executions (buy and sell)
• Settings changes
• API key updates
• 2FA enrollment and changes

Infrastructure:

• CORS restricted to configured origins
• Security headers (X-Frame-Options, X-Content-Type-Options, HSTS)
• API docs disabled in production mode
• Rate limiting on authentication endpoints