Trust
Jaha speaks in your meetings, and guests sit in some of them. So the real question is what it will say out loud, to whom, and with whom else in the room. Here is how it works, the facts underneath it, and what we can't claim yet.
The gate
Identity, then the source's own scope, then the room. Every question passes those three gates in that order, and any one of them can stop it before a word is spoken.
The facts
You can check each of these in the product on the day you install it.
One consent, revocable any time
Your Microsoft admin approves once and can cut Jaha off in the admin center at any time. The permissions on Microsoft's screen are the permissions it has.
No passwords, ever
Sign-in is Microsoft SSO only. Jaha never sees a password, and session tokens are stored hashed.
Strict separation between organizations
Each organization's meetings, documents and indexes are kept apart. One organization's data can never show up in another's answer.
Unknown voices get the safe default
A speaker Jaha can't identify gets only unrestricted material. Nobody gains access by being unrecognizable.
Refusals that give nothing away
A withheld answer names no document and hints at no content. Every one is logged with its reason for the host.
Encrypted connector secrets
Credentials for your tools are encrypted at rest with a dedicated key and masked wherever the UI shows them.
Retention you set
From 30 days on Free to a full year on Business, and your own policy on Enterprise. When it expires, it's deleted.
A record of everything
Access changes, ownership claims and every delivery to every tool are logged per meeting, per person and per rule.
Refusals
A refusal is the part of an assistant that people judge it by, because it is the part that happens in front of a customer.
It names nothing when it holds back
When it holds back, it doesn't say which document the answer came from, how many there were, or what they're called. “Nothing I can share on that here” is all it says. A refusal that describes what it's refusing is a leak with better manners.
It doesn't guess at an unknown voice
If Jaha can't tell who is speaking, it answers from unrestricted material only. Sounding like someone senior earns no partial credit.
It says when it doesn't know
No source, no answer. It says so out loud and moves the meeting on instead of making up something plausible from how the question sounds.
Every hold is written down
The host sees what was asked, that it was held back, and why. A refusal can be reviewed afterward instead of being a silence no one can explain.
Your data
Recaps are sent from a mailbox in your Microsoft 365 organization and filed in your drives, so the output of a meeting lives where the rest of your work lives. Transcripts and indexes are held per organization and expire on your plan's schedule.
Revoking consent in your Microsoft admin center cuts off access immediately. Anything already held is deleted when your retention window ends, or sooner on request.
Not yet
Everything above has shipped. These haven't, and you should hear it here rather than in week three of a security review.
No SOC 2 report yet
We're building the controls toward it, but the report doesn't exist yet and we won't suggest otherwise. If your process needs one today, we can't pass your review yet.
Health data: safeguards, not a compliance claim
Health data mode masks patient identifiers in everything that leaves Jaha, limits which AI and speech providers are used, and logs who opened what. It helps you meet HIPAA safeguards. It doesn’t make you compliant on its own, so ask us about a Business Associate Agreement before you record patient conversations.
SAML and SCIM are on the roadmap
Sign-in is Microsoft SSO, which covers the Teams organization you already run. SSO outside Microsoft and automated provisioning haven't shipped.
Model vendors are subprocessors
Answers are written by a hosted language model, so meeting text reaches the model vendor under a no-training agreement. If your policy forbids that entirely, no Jaha setting will satisfy it.