The short version.
We collect the account details needed to run your account, the targets and results of the scans you choose to run, your conversations with the AI features, files you upload, and the billing records required by law. We keep it on the server that runs the platform.
We do not sell your data, we do not run advertising or third-party analytics trackers on this site, and we do not train AI models on your content. You can export it or delete it whenever you like.
You can export or delete your data at any time. Contact jedneural@gmail.com for anything privacy-related.
Contents
Who we are
The JED CO-OP Security Platform ("the Platform", "we", "us") is operated by JED CO-OP, an independent
security engineering outfit. For the purposes of the EU/UK General Data Protection Regulation we are the
data controller for personal data processed through the hosted service at
jedcorp.ink.
Privacy contact and data-protection enquiries: jedneural@gmail.com.
Scope
This policy covers:
- the marketing site and the public sandbox at
jedcorp.ink; - the hosted Platform, including all tool, AI, chat, voice, forensics and reporting features; and
- support and other communications you have with us.
It does not cover third-party sites or services we link to, and it does not cover data you process inside the Platform about other people (for example, personal data you find while conducting an authorised test) — in that case you are the controller of that data and we simply store it for you. See section 4.
Information we collect
3.1 Account and authentication data
When you create or use an account we collect your username, email address, a salted PBKDF2-HMAC-SHA256 password hash (we never store your plaintext password), two-factor-authentication state, your role and subscription plan, and account preferences. We also record authentication events — sign-ins, failed attempts, session creation and revocation, and the IP address and user-agent associated with them — so we can secure the account and detect abuse.
3.2 Scan, engagement and forensic data
When you run a tool, the data you supply becomes part of your workspace: the targets you enter, the raw output of the tool, the parsed results, findings, timeline and evidence records, case and engagement details, and any exports you generate. This is stored so that scans are reproducible, history survives restarts, and reports can be produced.
3.3 AI and conversation data
Prompts you send to the AI features, the responses you receive, and the conversation history used to keep context between messages. When you use voice features, audio is processed to produce a transcript for the duration of the request; recordings are not retained as a matter of course. Call media between users is peer-to-peer and is not recorded by the server.
3.4 Files you upload
Files, attachments, images, wordlists and evidence you upload — including, for forensic features, copies of disk images or disks you are analysing. Uploads are stored under your account and are subject to size and type limits.
3.5 Billing data
Subscription plan, status, transaction references, amounts and invoices. We never receive or store your card details — payments are handled by our payment processor, and we only keep the identifiers needed to reconcile the payment and meet accounting obligations.
3.6 Technical, security and usage logs
Server and application logs (errors, warnings, request failures), audit/activity records of significant actions (tool runs, administrative changes, message sends), and usage counters used to enforce plan limits (scans per day, AI queries per day, concurrent scans, storage).
3.7 Public sandbox visitors
The sandbox on the home page is usable without an account. To enforce its fair-use limits we set a random session identifier in a cookie and record a count against it, together with the requesting IP address and timestamp. This is not linked to any account, is used solely for rate limiting, and is purged on a rolling basis. No scan profile or account is created for sandbox use.
How and why we use it
We use personal data only for the purposes below. Where the GDPR (or an equivalent law) requires a legal basis, we rely on the basis shown.
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the service | Account, scan, AI, upload and configuration data | Performance of a contract |
| Authenticate you and keep sessions secure | Credentials, session records, IP, user-agent | Contract; legitimate interests (security) |
| Enforce plan limits and fair use | Usage counters, scan/query counts, sandbox session id and IP | Contract; legitimate interests (abuse prevention) |
| Detect, investigate and prevent abuse, fraud or attacks on the Platform | Logs, audit trail, authentication events | Legitimate interests; legal obligation |
| Process subscriptions and payments | Billing data, transaction references | Contract; legal obligation (tax/accounting) |
| Send transactional email (verification codes, receipts, security notices) | Email address, name | Contract; legitimate interests |
| Provide support and answer enquiries | Contact details and correspondence | Contract; legitimate interests |
| Improve reliability and fix defects | Aggregated, largely non-identifying error and performance logs | Legitimate interests |
Where we rely on legitimate interests, we have balanced those interests against your rights: the processing is limited to operating and protecting the service, and you can object as described in section 10. Since the site sets no advertising or profiling cookies, no consent banner is required for marketing purposes — we simply do not do marketing tracking.
Cookies and local storage
We use a small number of strictly necessary cookies and browser-storage entries. There are no advertising cookies, no cross-site trackers and no third-party analytics on this site.
| Name | Type | Purpose |
|---|---|---|
auth_token | Cookie / local storage | Keeps you signed in between pages. Removed when you sign out or it expires. |
session | Cookie | Server-side session reference for the same purpose. |
jed_sbx | Cookie | Random, anonymous identifier used only to count free sandbox scans. Expires within 24 hours. |
jed_* preferences | Local storage | Interface state such as theme, workspace layout, panel sizes and your last selected model. Stored in your browser only. |
You can clear cookies and local storage at any time in your browser settings; doing so signs you out and resets local preferences, but does not delete your account data. Because these cookies are strictly necessary to deliver the service you requested, they do not require prior consent under the ePrivacy Directive.
Sharing and third-party processors
We do not sell, rent or trade personal data, and we do not share it for advertising or profiling. We disclose data only to the processors that make the service work, under contract and only for the purposes listed here.
| Processor | Role | What it receives |
|---|---|---|
| Cloudflare | Edge network, TLS termination, DDoS protection | All traffic metadata (IP, headers, request path) as part of delivering requests |
| Payment processor (Paystack) | Subscription billing | Email, name, plan, amount. Card data is entered in their environment and never reaches us |
| Transactional email relay (Brevo) | Delivery of verification codes, receipts and notices | Recipient address and the content of the message |
| AI inference providers (Groq, Google Gemini, DeepSeek) | Generating AI responses | The prompt and context needed to answer your request |
| Public data sources used by recon tools | Supplying scan results | The target domain or query — as it would be transmitted by any standard tool usage |
We may also disclose data where we are legally required to do so (for example a valid court order), or where it is necessary to investigate abuse that threatens the Platform or another person's systems. If the service is ever transferred to a new operator, we will give notice before data moves and remains subject to this policy or an equivalent one.
International transfers
The Platform is served from a single host you can locate and, on request, we can tell you which region it runs in. Some processors above are multinational and may process data outside your country, including in the United States. Where that happens we rely on appropriate safeguards — standard contractual clauses or an equivalent lawful transfer mechanism — and our contracts with those processors require them to protect the data to a standard consistent with this policy.
How long we keep it
| Data | Retention |
|---|---|
| Account record | While your account is active, then deleted on request and removed with the account |
| Scan output, findings, case files | Until you delete them. Stored on disk under your account and removed when you delete the scan, case or account |
| AI conversation history | Until you delete the conversation or your account |
| Uploads and evidence | Until you delete them |
| Sandbox usage counters | Rolling purge; identifiers expire within days |
| Security / audit logs | Retained for a limited period adequate for incident investigation, then rotated out |
| Billing and invoice records | Retained as required by tax and accounting law, even after account deletion |
Where you ask us to delete data, we remove it from live systems promptly. Residual copies may persist briefly in backups, which are overwritten on a rolling schedule.
Security
We take the security of your data seriously — it is, after all, the product. Measures include:
- passwords stored only as salted PBKDF2-HMAC-SHA256 hashes (100,000 iterations);
- signed session tokens plus server-side session records, verified on every request;
- optional two-factor authentication on every account, recommended for administrators;
- per-user isolation with ownership checks on every route that serves an artefact, so one account cannot read another's scans, uploads, evidence or conversations;
- transport encryption (HTTPS/TLS) for all access to the hosted service;
- secrets and API credentials never returned by read endpoints;
- strict validation and safety guards on inputs, including protections against server-side request forgery and self-scanning;
- audit logging of significant actions, with rate limiting on authentication endpoints;
- least-privilege tooling and read-only handling by default for forensic evidence, with write-blocker checks.
Your rights
Subject to your jurisdiction, you have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), subject to records we must keep by law;
- Restrict or object to certain processing, including processing based on our legitimate interests;
- Port your data — scan results and findings export to JSON/CSV, and we can provide your account data in a machine-readable format on request;
- Withdraw consent at any time where processing was based on consent;
- Not be subject to solely automated decisions that have a legal or similarly significant effect (we do not make any).
How to exercise them
Most rights are self-service: you can edit your account details, export results, and delete scans, conversations or your entire account from within the Platform. For anything else, email jedneural@gmail.com. We will respond within the timeframe required by applicable law (normally 30 days) and will ask for information needed to verify your identity before acting on a request — without that verification we cannot safely action account changes.
If you are in the EU/UK you also have the right to lodge a complaint with your national data-protection authority. In California, you have rights of access, deletion, correction and to opt out of the "sale" or "sharing" of personal information — we do neither, so there is nothing to opt out of. We do not discriminate against users who exercise their privacy rights.
Children
The Platform is a professional security tool and is not directed at children. You must be at least 16 years old to hold an account (or the minimum age of digital consent in your country, if higher). We do not knowingly collect data from children; if we learn that an account belongs to someone below the required age, we will close it and delete the associated data.
Automated decision-making and profiling
We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not build advertising or behavioural profiles. Automated processing is limited to operational matters: enforcing plan quotas, rate limiting, and suspending accounts that attack the Platform or breach our acceptable-use rules. Where an automated safeguard blocks an action, you can contact us and a human will review it.
AI features generate content in response to your prompts. They are assistive tools for professional use, not decision-makers about you, and their output should always be reviewed by a competent human before you rely on it.
Changes to this policy
We may update this policy to reflect changes to the Platform, our practices or the law. The version and dates at the top of this page always reflect the current policy. If a change materially affects how we handle your personal data, we will notify account holders by email or in-app notice before it takes effect. Continuing to use the Platform after a change takes effect means you accept the updated policy.
Contact and complaints
Questions, requests or concerns about privacy — or about how this policy is applied — should go to jedneural@gmail.com. We aim to acknowledge within two business days.
If you are not satisfied with our response, you may escalate to your local data-protection authority. We would appreciate the chance to resolve it with you first.