Security at Ojava
How we protect your data — and what we don't collect in the first place.
No file or email content collected
Ojava only ingests metadata: sign-in events, mailbox-rule changes, OAuth grants, MFA challenges, admin actions. We never download or store the body of emails, attachments, OneDrive files, or Drive files. If we don't need it to detect attacks, we don't ask for it.
Tenant isolation
Every database query is scoped to the requesting organization at the application layer; cross-tenant access is impossible by construction. We monitor every authenticated request and audit privileged actions — see the audit log in your dashboard.
Encryption in transit and at rest
All traffic is TLS 1.3 (no downgrades). Database, object storage, and backups are AES-256 encrypted at rest. OAuth tokens are additionally encrypted at the application layer with Fernet so they remain unreadable even with database access.
EU data residency
Production runs in Hetzner Frankfurt (Germany) — fully within the EU. Backups stay in the EU. Sub-processors are documented in the DPA and reviewed annually. Swiss-only residency is on our roadmap for Enterprise customers.
GDPR and Swiss nDSG compliance
We process personal data as a data processor on behalf of your organization. A Data Processing Agreement (DPA) is available on request and forms part of every paid contract. We support data access, export, and deletion requests via your account or by email to privacy@ojava.ch.
Responsible disclosure
Found a security issue? Please email security@ojava.ch with technical details. We acknowledge within 48 hours and will coordinate a fix.
SOC 2 roadmap
We are tracking SOC 2 Type II for Year 2 of operations. In the meantime our internal controls follow the SOC 2 control catalogue and we publish material changes (sub-processors, DPA, incident history) to customers.