Security approach
Jennason’s public site is designed to minimize unnecessary data collection and third-party code. Production hosting should enforce HTTPS, restrictive security headers, protected deployment access, dependency review, logging, backups, and timely updates.
The planned Azure documentation portal will keep customer files private, authenticate approved users, apply solution-specific authorization, and issue short-lived download access rather than permanent public file URLs.
Data and portal assumptions
- Public marketing content remains separate from private customer documentation.
- Portal permissions are assigned by customer organization and authorized solution.
- Documents are stored in private Azure Blob Storage.
- Authorized downloads use short-lived access tokens or equivalent server-mediated controls.
- Authentication, access, and document events are logged at a level appropriate for security and support.
Report a security concern
Send a concise description to nextsteps@jennason.com with the subject “Security Concern.” Include the affected page or service, steps to reproduce, and potential impact.
Please do not access customer information, disrupt services, perform destructive testing, or publicly disclose a suspected vulnerability before Jennason has had a reasonable opportunity to investigate.
Sensitive information
Do not send passwords, API credentials, production serialization data, protected health information, or other highly sensitive material through ordinary email or public contact channels. Jennason will provide an appropriate secure-transfer method when needed for a project.
Production controls included in this build
The build includes example Azure and static-host security-header configurations, a content security policy, restrictive browser permissions, a responsible-disclosure file, and no third-party analytics or advertising scripts.
Hosting-specific settings must be validated after deployment because security headers cannot be fully tested from local files.