Security
Last updated: November 3, 2026
AI Revenue Accelerator handles our customers' most sensitive business data — revenue, pipeline and customer records — and bills on the results it measures. These are the controls Jozie AI Inc. builds into the platform.
Tenant isolation
Every customer organization's data is scoped to that organization and checked on every request. Platform administrators can open a customer organization only through an audited path.
Access control
- Passwords hashed with bcrypt; revocable sessions.
- Two-factor authentication (TOTP), which an organization can require for all its users.
- Role-based access with personas for executives, sales, marketing, finance, AI operations and analysts. Rights that set fees or issue statements are reserved to the platform operator.
- Scoped API keys, stored only as hashes, bound by each organization's data-access policy.
Encryption
- TLS for all traffic, with HSTS and a strict Content-Security-Policy.
- AES-256-GCM encryption at rest for integration credentials, webhook secrets, two-factor secrets and contact phone numbers; database-level encryption at rest in production.
- Inbound webhooks verified with HMAC-SHA256 signatures.
AI guardrails and human approval
- AI agents have no ability to make payments, change prices, issue refunds, offer discounts or sign contracts; attempts are blocked and logged.
- External emails, campaign launches, budget changes and baseline adjustments require approval by an authorized person, with a four-eyes rule.
- Outbound email is checked for consent, suppression, sending limits and prohibited content.
Auditability
- Audit logs of sign-ins, permission and policy changes, approvals, exports and administrator access.
- Execution logs for every AI agent task and model call.
- Fee statements sealed with a SHA-256 hash of their full calculation and verified on every view.
Reporting a vulnerability
Please report security issues privately to legal@jozieai.com. We appreciate responsible disclosure and will respond promptly.