Vulnerability Disclosure Policy

Keeping your control logic, the JasperX platform and your controller's local web interface secure is important to us. For any security-related questions, contact us at [email protected].

Our Infrastructure

We depend on the following sub-processors. Control logic you develop and AI chat prompts are sent to our servers to run the JasperX platform and its AI features.

• Google Cloud Platform (GCP) Sees and stores data: Our infrastructure is primarily hosted on GCP. Most of our servers are in Australia (Sydney), with some load balancing servers allocated by GCP automatically in other regions.
• Anthropic Sees prompts and logic when we use it: We may use Anthropic's Claude models to give AI responses. Anthropic's commercial API does not use your data to train models by default.
• xAI Sees prompts and logic: We use xAI's Grok models to give AI responses. xAI does not use your data to train models. It deletes it when the response is delivered or one hour after the request is processed, whichever comes first, and keeps no copy. xAI processes requests outside Australia, including in the United States.
• OpenAI Sees prompts and logic when we use it: We may use OpenAI's models to give AI responses. OpenAI does not use your data to train models. OpenAI may keep it for up to 30 days to check for abuse, and processes requests outside Australia, including in the United States.
• Google Workspace May store data for debugging: We use Google Workspace to collaborate. We may send snippets of prompts in our internal emails for debugging.
• Stripe Sees no code data: We use Stripe to handle billing. Stripe will store your personal data (name, credit card, address).
• Resend Sends our emails: We send our service emails, such as sign-in and password emails, invitations and notifications, through Resend, so your email address and the email's content pass through it. Resend processes them outside Australia and stores its records in the United States.
• Google Analytics Sees website usage: We use Google Analytics on our websites and download pages to see how they are used.

Reporting a Vulnerability

Please report security vulnerabilities by email to [email protected], not publicly.

We aim to acknowledge vulnerability reports promptly and to fix confirmed vulnerabilities as soon as we can. We notify data breaches as the Privacy Act 1988 (Cth) requires.

We appreciate your help in making JasperX and your controllers more secure for everyone. Thank you for your support and responsible disclosure.