How Junction keeps your data safe

Junction only ever asks your systems to read. It cannot create, edit, delete, pause, post or spend anything, and every request is controlled by the roles and permissions you set. We also ask you to connect with a login or key that has read access only, so even a flaw on our side could not write.

Whatever someone types into their AI tool, it is answered from fixed, checked requests. Nothing typed in a question is ever run as a command on your systems. For systems inside your network, our cloud sends the agent a structured request, never a command to run.

• The agent on your server connects outward over HTTPS, so you open no inbound firewall ports.
• You can revoke an agent in the portal, and it is disconnected within seconds.

• Administrators set roles and permissions: which systems, which kinds of data and even which jobs or accounts each person can reach. Access can only be narrowed, never widened.
• Every request carries the identity of the person asking, and each company’s systems are invisible to every other company.
• A company whose subscription lapses gets no data.

• AI tools connect using the OAuth 2.1 standard. Access is short-lived, and your AI tool’s token is never passed on to your other systems.
• People sign in to the Junction portal with email and a confirmation code, Google, Microsoft, or your company’s single sign-on. Two-step verification with an authenticator app is required for company administrators.

Logins and keys you enter in the portal are encrypted before they are stored and are never shown again, to you or to us. Error messages shown to the AI never contain secrets or technical details of your systems.

An audit log records who used which tool, system and kind of data, the outcome, row counts and timing, and administrative changes. It never records the values you asked for or the data returned. Logs are kept for 400 days by default.

Separately, to improve answers, we keep the questions put to the service for 90 days under a pseudonymous code, never with the data returned and never with values from personal or payroll fields. Nothing shows it back through the portal or any interface, and a company can ask us to turn it off.

Email [email protected] to ask for our security questionnaire answers or a call with an engineer, or book a walkthrough. To report a vulnerability, email the same address; please give us reasonable time to fix it before disclosing it.