Back to Home
Trust & Security
JurisNote is built for law students, and we take the security of your academic data seriously. This page summarizes who processes your data, how it flows through our platform, and the privacy rights and controls available to you.
Subprocessors
We use the following third-party services to operate JurisNote. Each processes only the data needed for its function.
| Service | Purpose | Data processed |
|---|---|---|
| Vercel | Application hosting (frontend + API) and web/performance analytics | The full request and response contents transiting the application — account, study, and content data, AI inputs, and uploaded files — plus IP addresses and, consent-gated, page-view and performance telemetry |
| Supabase (PostgreSQL) | Primary application database | Account and authentication data (including password hashes and two-factor/OAuth tokens), study and content data, billing metadata, IP and device identifiers, and consent/audit records |
| Upstash (Redis) | Caching, rate limiting, background job queue, and short-lived auth tokens | Rate-limit counters and cached values, queued billing-webhook payloads, and single-use authentication tokens |
| Wasabi | File storage (uploads, media, exports) | Uploaded files and generated documents |
| Google (OAuth, Calendar, Places) | Sign-in, calendar sync, nearby locations | Email, profile, calendar (opt-in), precise device location (opt-in) |
| Cloudflare (Turnstile) | Bot / abuse protection on public forms | Challenge tokens, IP address, and browser/device signals |
| OpenAI | AI study features, transcription, semantic search | Prompts and content you submit; audio you upload or record for transcription; and the text of your study materials indexed for search |
| Stripe | Subscription billing and payments | Billing contact, payment metadata (card data handled by Stripe) |
| Resend | Transactional, notification, and marketing email | Email address, message content (may include your name, study activity, and subscription status), and email engagement events |
| Sentry | Error, performance, and session-replay monitoring | Diagnostic error context, user identifiers, and sampled session replays (text masked, media blocked) |
| VirusTotal | Malware scanning of uploaded files | File hashes of uploads |
| Google Analytics | Consent-gated web/product usage analytics | Page-view and interaction events plus an analytics cookie/identifier and IP address (used transiently by Google for approximate geolocation, not retained by us) — collected only after you allow tracking, and suppressed by a Do-Not-Sell or GPC opt-out; never used for advertising |
How your data flows
- You create an account and study materials, which are stored in our primary database (Supabase/PostgreSQL) with per-user access controls.
- AI study features send the content you submit to OpenAI to generate briefs, cards, and feedback; audio you upload or record is sent to OpenAI for transcription, and AI-generated content is labeled as such.
- Uploaded files are stored in Wasabi and checked against a known-malware hash database (VirusTotal); files matching known malware are blocked. Because this is a signature-based check, it cannot guarantee detection of novel or previously-unseen malware.
- Billing is handled by Stripe; JurisNote never stores full card numbers.
- We use privacy-conscious, consent-gated web analytics (Vercel Analytics and Google Analytics) to understand aggregate product usage. These load only after you allow tracking, are suppressed by a Do Not Sell or Share opt-out or a Global Privacy Control (GPC) signal, and are never used for advertising, ad targeting, or cross-site tracking. We do not sell or share your personal information for advertising. We honor the GPC signal and provide a Do Not Sell or Share control whose preference stays on file.
Your privacy rights & controls
- You can request access to, correction of, deletion of, or a portable copy of your personal data. We respond within the timeframes the law requires — 30 days under the GDPR and 45 days under the CCPA/CPRA.
- You can delete your account and content from your account settings at any time. Records we keep for security and audit purposes are retained in de-identified form. If we have paid you (for example, through our referral or ambassador program), tax and financial-recordkeeping laws require us to retain identifiable payment records — such as your name and tax and payment information — for as long as the law requires.
- Items you move to trash are permanently purged after 30 days.
- We do not sell or share your personal information. You can register a Do Not Sell or Share preference, and we honor the Global Privacy Control (GPC) browser signal.
For institutions
- Single sign-on is supported via SAML 2.0 and OpenID Connect, with automated user provisioning and de-provisioning through SCIM 2.0.
- For institutional deployments, administrator access to a student’s records is recorded in an append-only, tamper-evident audit log, and students can review who has accessed their records.
- Institutional security documentation is available on request — contact us at the address below.
Data residency & security practices
JurisNote is hosted in the United States. Data is encrypted in transit (TLS), sensitive fields are encrypted at rest, and access to your data is scoped per user.
- Authentication: multi-factor authentication via authenticator apps (TOTP) and phishing-resistant passkeys (WebAuthn/FIDO2), plus single sign-on for institutions.
- Application security: a nonce-based Content Security Policy, cross-site request forgery (CSRF) origin validation, server-side request forgery (SSRF) protections, and rate limiting that fails closed.
- Incident response: automated account lockout, session invalidation, and security-alert emails when suspicious activity is detected.
For security questions, subprocessor change notifications, or to request our institutional security documentation, contact support@jurisnote.net. See also our Privacy Policy and Accessibility Statement.
Report a vulnerability
We welcome responsible disclosure of security issues. If you believe you have found a vulnerability, email security@jurisnote.net. We will not pursue legal action against researchers who act in good faith and follow this disclosure policy.