Security and Trust
Last updated: October 12, 2026
JorgAI runs rules-based automated trading inside customers' own brokerage accounts, so the data it holds includes brokerage access tokens and account activity. These documents describe how that data is protected. They are the same documents JorgAI provides to broker and vendor reviews.
Policies
- Information Security Policy: How JorgAI protects customer data: access control, encryption, broker credentials, vendors, change management, logging, continuity and incident response.
- Cybersecurity Policy: The technical controls behind JorgAI: network, identity, secrets, application security, vulnerability management, monitoring, deployment, backup and recovery.
- AI Usage Policy: How JorgAI uses AI: what data is and is not sent to model providers, how AI output is used, and the limits that protect customers and partners.
- Third-Party Vendor Review Process: How JorgAI reviews every vendor before use and annually: data minimization, security posture, written terms, approval and retirement.
- Incident Response Summary: What JorgAI does after a suspected security incident: containment, assessment, partner and customer notice, recovery targets and reporting.
Subprocessors
Vendors that process data on JorgAI's behalf. All are located in the United States. This list is also in the Privacy Policy.
| Provider | Purpose | Data received |
|---|---|---|
| Amazon Web Services | Hosting, database, cache, secrets management, logging | All production data, encrypted at rest |
| Apple (APNs) | Push notifications the customer enables | Alert text, which may include symbol, quantity and price |
| Resend | Transactional email the customer enables | Email address and alert text |
| Sentry | Application error monitoring | Error reports; no customer account data by design |
| Stripe | Subscription billing | Payment and billing details; no brokerage data |
| Anthropic | AI model provider | Market data and the customer's own rule settings; never brokerage account data |
| Loops | Marketing email | Email address and account-status flags only |
| Alpaca Data, Massive (Polygon) | Market data and news | None; JorgAI sends only ticker symbols |
| Google Analytics, Microsoft Clarity | Website usage analytics | Anonymized usage data |
Facts in brief
- All data is stored and processed in the United States.
- Brokerage access is obtained only through each broker's own OAuth flow or customer-created API keys; JorgAI never stores a brokerage password and cannot withdraw or transfer funds.
- Brokerage tokens are encrypted at rest with a key held separately from the database, and are deleted the moment a customer disconnects.
- Customer data is never sold or licensed, and is never used to train AI models. Brokerage account data is never sent to AI model providers.
- JorgAI does not currently hold a SOC 2 or ISO 27001 attestation.
Contact
Security questions and vulnerability reports: support@jorgai.com. Partner and vendor reviews: admin@jorgai.com.