SECURITY AND PRIVACY AT JATZOUnderstand how Jatzo handles your data.

Processed for the check, then released.

• Processed for the check

  Jatzo reads the submitted message and supported attachments to produce the analysis, then releases them from application processing.

• Restricted processing

  Supported uploads are processed in restricted workers. This reduces risk; it does not make an attachment safe to open on your own device.

• No generative AI

  The current email engine uses programmed checks and scoring. It does not send your email to a generative-AI model for analysis.

• Copies you control

  Your browser and downloaded or emailed reports can hold additional information. Deleting a case cannot recall those copies.

What is kept, and for how long.

• Findings kept in history

  History saves the subject, score and compact findings. It does not save the raw email or attachment contents. Subjects may contain personal information.

• Up to 90 days

  Saved cases are kept for up to 90 days, or less when your plan's history limit is reached, and you can delete a case or your whole account whenever you choose.

• Backups expire

  Every backup, on the server and off it, expires within 30 days, and a deleted account or case is not brought back by a restore.

You can delete saved cases or your account. Business cases, managed backups and reports held outside Jatzo have separate conditions; account deletion does not erase every copy everywhere. Read the full retention and deletion rules

Hosted in the European Economic Area.

• The service and its database

  Hosted with a European hosting provider in Germany, with the backups kept on the server.

• An encrypted copy off the server

  A copy of the backups is kept in Finland, encrypted on Jatzo's server before it leaves, with a key the storage provider does not hold. Both providers are named in the document pack sent to customers on request.

• Encrypted in transit

  Every page and every request from the Outlook pane is served over HTTPS, and browsers are told to use nothing else.

Who can see what.

• Business findings belong to the workspace

  The admin and moderators can see all retained business cases; members can open their own. Where an IT support company is engaged to look after the workspace, its engineers can see them as well, and every day one of their people opens the workspace is recorded in the workspace's activity log. A business account has no personal history while it belongs to a workspace.

• When someone leaves

  Their business cases remain with the workspace without their contributor reference. Staff should understand this access before joining.

• Support sees a case only when you send it

  Only when you press Send to support: the case reference, the date, the score, the rules that fired and your plan. Never the subject, the message, addresses, links or attachments.

• Accounts and the operator console

  Passwords are stored only as salted one-way hashes. Jatzo's own operator console opens only with a code from an authenticator app as well as the password, and its support actions on an account are recorded.

See how team access works

Which outside services receive information.

• Link reputation

  On plans with live link reputation, Google Web Risk receives selected URLs. Other selected lookups can send public IP addresses or domain names to network-information providers. These lookups do not require sending the complete email.

• Registries and network records

  RIPE NCC receives a public IP address for its registry and abuse contact records, and domain registries receive a domain name only, through their public RDAP services.

• Email Jatzo sends

  Jatzo's own email goes out through Microsoft 365: a report you ask to be emailed, with your address and the case reference, and notices about your plan. A record of each one is kept, never its words.

• Payment

  If checkout is enabled, Stripe receives the purchase information needed for the payment. Jatzo keeps the order and payment identifiers, never card details.

• Nothing on the Free plan

  On the Free plan, nothing from the email you check is sent to anybody else.

The privacy notice names the providers and explains the information they receive, hosting and transfer details. Read the provider disclosures

The documents your reviewer will ask for.

Ask once and both come by email, so a review does not wait on a back and forth about what Jatzo does.

• A security questionnaire

  Every standard review question, answered from what the code does rather than from memory, and dated.

• A data processing agreement

  A UK GDPR Article 28 processor agreement, with the annexes filled from what Jatzo actually does with your information.

• A published disclosure route

  A vulnerability disclosure policy, an address to send one to, and security.txt served from this domain.

What Jatzo does with an email is set out on this page: it is read in a restricted worker, the findings are kept and the message is not, and everything is hosted in the European Economic Area. The privacy notice holds the retention table in full.

Found a security problem? Tell us.

Use the Security / Privacy category on the contact form, or email contact@jatzo.co.uk. Describe what you found and how to reproduce it, and we will reply by email.

Do not include passwords, recovery codes or sensitive email contents, and do not test against other people's accounts or data.