Skip to content
jekon.
Security at Jekon

Your ledger is the one thing we never play loose with.

Here’s how Jekon protects your financial data — in plain language, and specific enough for your auditor.

  • Per-company isolation
  • AES-256-GCM encryption
  • Append-only audit log
  • Read-only connections

How we protect your data

01

Your data, walled off

Every company’s records are kept apart, and every request is limited to the organisation that made it.

  • Every query is scoped to the signed-in organisation
  • Agency access to a client is checked against the firm’s client list on every request
  • Each agency client is its own organisation, with its own data
02

Credentials, locked down

The keys to your accounting and bank connections are treated like the keys to the vault.

  • OAuth tokens encrypted at rest with AES-256-GCM
  • Secrets live in a managed secret store, never in code
  • Secrets, tokens and keys are scrubbed from application logs
03

A history no one can rewrite

Every match, approval and reversal is recorded — and the record can’t be quietly changed.

  • Append-only audit log, enforced by the database
  • Each action stores the state it replaced, so it can be undone
  • Review the full audit trail in Jekon at any time
04

Least access, by default

Jekon asks for only what it needs, and people only get what their role allows.

  • Read-only access to your ledger and bank feeds
  • Role-based permissions: only admins can approve or reverse
  • Jekon staff admin access requires 2FA and an approved network
05

Safe document intake

Files from WhatsApp and uploads are checked before they reach your inbox.

  • Every WhatsApp message is signature-verified as coming from Meta
  • Uploads are limited by file type and size; executable files are rejected
  • Rate limits on sign-in and API endpoints

No AI decides what gets matched.

Matching and routing use deterministic, testable rules — the same inputs always produce the same result. If AI-written explanations are switched on, sensitive identifiers like card and account numbers are stripped before anything leaves our servers, and matching keeps working if the AI is unavailable.

Where your data lives

Hosting
Amazon Web Services
In transit
TLS on every connection
At rest
Encrypted database, cache and backups
Your rights
Access, correction and deletion on request — see our Privacy Policy

Found a vulnerability?

We want to hear about it. Report it privately and we’ll respond quickly, keep you updated, and credit you if you’d like.

Report a vulnerability

Have a security questionnaire? Bring it to the demo.

Get early access