Security and disclosure.

How we protect it

• Encrypted connections only, with strict transport security.
• Strict security headers, including a content security policy.
• Bot protection, rate limits and validation on every form and on the assistant.
• Personal data stored only where needed, deleted on schedule, and reachable only by the studio team with two-factor sign-in.
• Signed DNS (DNSSEC), a locked domain and signed email.
• Dependencies pinned and audited on every change.

Procurement teams can download our security overview from the Readiness page.

Report a weakness

Email security@juastudio.com with the details and the steps to reproduce it. Our security.txt file is at /.well-known/security.txt.

We will:

• confirm we received it within three working days;
• keep you informed while we fix it;
• credit you, if you wish, once it is fixed.

Please:

• give us reasonable time to fix it before telling anyone;
• do not access, change or delete other people's data;
• do not run denial of service tests, social engineering, physical tests or spam;
• test only juastudio.com and its subdomains.

If you act in good faith within these rules, we will not take legal action against you for your research. We do not offer payment for reports at this stage.