Security & data

Last updated 17 October 2026

Grievances are some of the most sensitive records a company holds. This page explains plainly how Jurisly handles them. Jurisly is operated by C-Vids Productions (UEN 53119647W), Singapore.

Where data is stored

The database and file storage run on Supabase in Singapore (AWS ap-southeast-1). The app runs on Vercel in Singapore.

How it is protected

• Grievance text, messages, internal notes and HR records are encrypted by the app (AES-256-GCM) before they are stored, so a copy of the database alone can't be read.
• Photos and videos are kept in private storage. They can only be opened through links that expire, issued after the same access check as the case.
• All traffic uses HTTPS.
• Sign-in uses a one-time code sent to your work email. There are no passwords to leak.
• The database can't be reached from the browser: every request goes through the app's own access checks.

Who can see a grievance

• Only members of the company's HR team in Jurisly.
• The employee's own manager is kept out of their case automatically, and can't be assigned to investigate it or sent the case file.
• Every time someone opens a case it is logged. Owners can see who opened it and when.
• Internal notes, messages and written outcomes can't be edited or deleted once saved, so the record stays as it was.
• Anonymous reporters are identified only by a case code and a PIN. We keep only a scrambled (hashed) copy of the PIN.

Services we use

• Supabase: database and file storage (Singapore).
• Vercel: hosting (Singapore) and cookie-free page analytics.
• OpenAI: translation and the optional AI tidy-up. Only the text being translated or tidied is sent, when someone uses those features.
• Resend: sending emails. Automatic emails about a case never contain what was written in it.

How long data is kept

• Case records are kept until the employer deletes them or asks us to.
• Photos and videos are kept too, unless the employer sets an evidence retention period (90 days to 1 year, or MOM's current record-keeping guidance). Then a case's files are deleted that long after it is closed, and only once HR has downloaded the case file. The written record is not affected.
• Sign-in codes and expired sessions are deleted within a day.

What we don't claim

Jurisly does not hold security certifications such as SOC 2 or ISO 27001. Jurisly is not legal advice.

Questions or a security concern

Email support@jurisly.ai. See also our privacy notice.