Security and data protection
Updated October 2026
What JRNY does today to protect your CRM data.
Data Protection
- Primary database hosted on Supabase in AWS eu-north-1 (Stockholm)
- Encryption in transit with TLS and at rest
- New API keys, and the stored sign-in tokens for connected Gmail, Drive and LinkedIn accounts, are encrypted (AES-256-GCM)
- Multi-tenant data isolation with row-level security
- Daily database backups (Supabase), plus, where the nightly backup is switched on, a CSV copy in a private GitHub repository
Your data
- Export your Hot, Cold and Signed companies, with contact details, to Excel
- Ask for deletion by emailing [email protected]
- Changes to companies, contacts, people and interactions are recorded in an audit log, including a copy of each changed or deleted record with its personal details so changes can be undone, and each audit entry is deleted automatically 12 months after it was written
Is JRNY SOC 2 certified?
No certification is claimed for JRNY itself. According to Supabase security documentation, Supabase, our database host, holds a SOC 2 Type 2 report.
How does multi-tenant isolation work?
Each workspace's data is isolated from other customers using PostgreSQL Row-Level Security (RLS). BetterQA staff with administrator access can access workspaces for support and operations.
Related Pages
Built by BetterQA.