Last updated: October 23, 2026 · Version 2026.10.23
This revision expands the published service and information-handling explanations. Accepted orders and signed agreements remain relevant to the service purchased.
1. Shared responsibilities
JIJ treats security as an operational responsibility across websites, hosting, support, billing, and private tools. Controls depend on the service and scope. A hosted website, custom application, third-party add-on, and client-managed CMS may have different maintenance responsibilities.
This policy is not a certification, a guarantee against incidents, or permission to conduct security testing. Confirm requirements that need a specific contractual security schedule before using a service for restricted data.
2. Accounts and least-privilege access
Use unique passwords, protect recovery email, and enable available authentication protections. Give named users only the permissions they need. Remove former staff and expired integration access. Avoid sharing a single login where an appropriate delegated role is available.
JIJ may verify identity and authority before sensitive changes. Client-portal sign-in, a copied email, an API key ID, or a faxed form is not sufficient evidence for every operation. Store actual secrets only in the approved credential workflow, outside ordinary public files and messages.
3. Hosting and application maintenance
Keep supported software, plugins, themes, dependencies, and device systems updated. Remove unused code and accounts. Use lawful licensed software and avoid untrusted packages. Check the purchased scope before assuming JIJ performs every update or application audit.
JIJ uses controls such as protected access, service separation, encrypted website connections, and operational monitoring as appropriate to the service. Backups should be independent and recovery-tested. Any particular backup frequency, retention, or recovery commitment must be defined in the service scope.
4. Authorized changes and recovery
Technical work may affect data, DNS, email, access, billing, or availability. Agree the system, purpose, allowed actions, backup, window, and rollback plan before a consequential change. Automated or AI-assisted support remains subject to the permissions and confirmation steps of its workflow.
A restore can overwrite current data. A domain or account transfer requires verified authority. JIJ may take urgent protective steps to contain active risk; subsequent investigation, recovery, and client communication depend on the facts and service terms.
5. Vulnerability and abuse reports
Report suspected vulnerabilities to support@jijweb.com. Include the affected domain or product, a concise description, reproducible steps, observed impact, and a safe proof of concept. If the issue involves exposed data, describe the category and location without copying more information than necessary.
Do not exploit beyond the minimum needed to demonstrate an issue, access another person's account, disrupt service, alter data, or publicly disclose private records. This policy does not offer a bounty or blanket legal authorization for testing. Agree any testing engagement in writing.
6. Incident handling and records
We may investigate, preserve evidence, isolate affected services, revoke access, coordinate with a provider, restore appropriate backups, or request client remediation. Keep incident records factual and distinguish confirmed evidence from hypotheses. Notification obligations are assessed under the applicable agreement and law.
Contact us promptly about suspected compromise, unexpected account changes, or a fax/document sent to the wrong recipient. Use a safe channel and case reference. After containment, review access, configuration, monitoring, and recurrence-prevention actions with the responsible owner.