Your workforce data, handled with restraint.
JobRoute AI Spend reports on roles, not on people. IDs, work emails and logins are hashed before storage, and we keep only what the analysis needs.
Hashed before it is stored.
Employee IDs are hashed before they are stored
IDs are hashed with HMAC-SHA256 (server-side key, separate for each customer) before storage; the raw ID is never saved. Manager references are hashed the same way, which keeps the org chart.
Work email and vendor logins are stored only as keyed hashes
To match AI usage to the roster, JobRoute reads each work email and each vendor login, such as a GitHub username. Each one is turned into a keyed hash (HMAC-SHA256, server-side key, separate for each customer) before anything is saved. The address or login is never stored in readable form and is used for nothing else.
No names are stored
A roster record holds an ID hash, a work email hash, role title, department, tenure, seniority band and location, plus a pay band label when your roster includes one. There is no field for a name or a date of birth, and no pay amount is stored.
A keyed hash is still personal data
A hash cannot be turned back into an address, but it still stands for one person, and someone holding both the key and an address could match the two. So this data is pseudonymous, not anonymous, and we treat it as personal data.
AI usage and output are stored per person and shown only by role
Usage and output are kept against the hash of the person, never against a name or address. Screens, exports and PDFs show roles only, and only groups of at least the minimum group size: 10 people by default, never below 5. Smaller groups are combined or withheld.
No scores or rankings of people
JobRoute does not score or rank individual people on their AI use or their output, and no screen shows the AI use of one person. Workforce scores describe the role a person holds, not the person.
No hash leaves the API
No identifier hash and no raw record is returned by the API or included in an export. AI usage and output leave the API as role and group figures only.
Customer keys and tokens are encrypted, and access is read-only
A live connection to Microsoft, GitHub, Claude or ChatGPT keeps a key or token so it can sync. Each one is encrypted before it is saved (AES-256-GCM envelope encryption, bound to your workspace and that connection) and is deleted when you disconnect. JobRoute asks for read-only access only: Microsoft User.Read.All and Reports.Read.All; GitHub Copilot metrics, organization members, pull requests and metadata; a Claude analytics read key; a ChatGPT analytics usage read key. Workday and SuccessFactors credentials are used once for a single roster import and are not stored.
Hardened infrastructure.
Connectors are guarded against server-side request forgery
Outbound requests block private, loopback, link-local, and cloud-metadata ranges, re-check hosts to defeat DNS rebinding, and never follow redirects.
Encryption in transit and at rest
All traffic is HTTPS, enforced for connector URLs in production. Data at rest lives in managed Azure Database for PostgreSQL, encrypted by default with Microsoft-managed keys.
Strict per-tenant isolation
Every query is scoped to your tenant; one company can never read another’s data. Sign-in is passwordless: a single-use magic link issues a signed, httpOnly, secure session cookie.
Hosting
JobRoute AI Spend runs on Microsoft Azure in the United States: Azure Container Apps for the API, Azure Database for PostgreSQL for the data. We will confirm the region in writing for your review.
Your data, your terms.
Disconnect and delete at any time, including after a trial ends
A workspace admin can disconnect any source at any time and delete the data it brought in. An admin can also delete all workspace data themselves, in the product, with two choices. The first removes the AI spend data: usage, output, seats, matched logins and every connection with its key or token. The second removes that and the roster too, with its scores, role mappings, role documents and output measures. Both keep working after a trial has ended. The workspace account, its licence and its users stay, so the people who own it can still sign in; we close the account itself on request.
Access on the vendor side is yours to remove
Disconnecting deletes our copy of the key or token. JobRoute cannot remove the approval inside Microsoft Entra, GitHub, Claude or ChatGPT, so the product shows the one step your admin takes there.
Grounded in public data, not a black box
Scores are deterministic over public sources (Anthropic Economic Index, O*NET, BLS, WEF) applied to your roles. Same input, same result; every figure is explained on the Methodology page.
What we have not done yet.
Stated plainly rather than implied. As of today:
- A SOC 2 report. JobRoute does not have one and holds no other security certification. We can share our security practices in detail under NDA in the meantime.
- Self-service export in the product. Today an export is handled on request through support. Deleting workspace data, the roster included, is already in the product.
- Server-side session revocation. Sessions currently expire on a fixed schedule and cannot be revoked one by one.
Questions from your security team?
We are glad to walk through any of this in detail, share documentation under NDA, or confirm specifics in writing for your review.