Security
How does JamCoach keep my data safe?
JamCoach keeps each company's coaching data inside its own organization: every query is filtered to the organization you are signed in to. Sign-in is rate limited, breached passwords are refused, two-factor and passkeys are available, and API keys are stored only as SHA-256 hashes, scoped and revocable.
What protects each part of JamCoach?
| Area | Control |
|---|---|
| Sign-in session | HttpOnly, SameSite cookie, Secure over HTTPS, checked against the account on every request. |
| Sign-in attempts | Rate limited per address; five wrong passwords lock the account for five minutes. |
| Passwords | At least 12 characters; passwords seen in known breaches are refused. |
| Two-factor | Authenticator apps and passkeys. |
| Organizations | Every row belongs to one organization, and every query is filtered to the signed-in one. |
| API keys | Shown once; stored as a SHA-256 hash; scoped, expirable and revocable. |
Security questions
How are API keys protected?
API keys are shown once, when you create them. JamCoach stores only a SHA-256 hash of each key plus a short prefix for recognizing it. Each key has scopes (read or write), an optional expiry and a last-used time, and can be revoked at any moment.
Found a vulnerability? Send a security report through the contact form.