Security
Juryline holds applications people worked hard on and scores that decide prizes and money. This page explains how we protect them. Questions go to hello@juryline.com.
Where data lives
The database, the files and the app run in the EU, in Frankfurt, Germany. Everlong s.r.o. is a Slovak company. Our providers and what they do are listed at the end of this page.
Who can see what
Every read and every change goes through row level security in the database. The rules are part of the database itself, so a mistake in a page cannot show data to the wrong person.
- Organisers see the programmes of their organisation. Viewers read, managers run programmes, owners also manage people and billing.
- Jurors see only the applications assigned to them, without the fields the organiser hides.
- Applicants see only their own applications.
Automated tests check these rules for every role.
Signing in without passwords
Nobody has a password in Juryline, so there is none to steal or reuse. People sign in with a one-time code sent by e-mail; jurors use a personal link from their invitation. Sessions end after 30 days without use.
Files
Files are kept in private storage. A download link is created only after a permission check and works for 5 minutes. We check the real type of each file from its content, not only its name, and limit the size to 25 MB.
Results you can prove
- Scores, screening decisions, conflict declarations and results decisions are never overwritten. A change is a new record next to the old one.
- Assignment of applications to jurors uses a recorded seed, so it can be repeated with the same result.
- When a round is locked, Juryline seals the results in a protocol with a SHA-256 hash and a verification code. Anyone can check a protocol on the verification page, and check that a PDF is unchanged without uploading it.
Support access
When an organiser asks for help, our support can open its organisation read-only for 2 hours, with a recorded reason. The organisation sees every session in its settings. Support never changes programme data.
Audit log
Exports, protocol downloads, role changes, support sessions and billing events are recorded with who and when, without application content, and kept 24 months.
In the browser
No third-party scripts and no advertising. Visits are counted by Juryline itself, without cookies and without personal data. A strict content security policy, protection against framing and HTTPS with HSTS on every page.
Retention
Each programme is deleted 24 months after its results are published, unless the organiser sets a different period. Owners get an e-mail with an export offer a month before. Backups are overwritten within 7 days.
AI
AI is used only to draft a form from a call text the organiser pastes. Applications, scores and personal data from programmes are never sent to AI.
Reporting a vulnerability
If you find a security issue, write to hello@juryline.com with the details. Please do not access other people's data and give us time to fix the issue before you publish it. We thank everyone who reports responsibly and credit you if you wish.
Providers
| Provider | What it does | Where data is | Safeguards |
|---|---|---|---|
| Supabase, Inc. (USA) | Database, sign-in, file storage | EU (Frankfurt, Germany) | Data processing agreement, standard contractual clauses |
| Vercel Inc. (USA) | Hosting of the app | EU (Frankfurt, Germany) | Data processing agreement, standard contractual clauses, EU-US Data Privacy Framework |
| Resend (Plus Five Five, Inc., USA) | Sending e-mails | Sending from the EU (Ireland); delivery logs in the USA | Data processing agreement, standard contractual clauses, EU-US Data Privacy Framework |
| Anthropic, PBC (USA) | AI draft of a form from an organiser's call text; never applications or scores | USA | Data processing agreement, standard contractual clauses |
Card payments are handled by Stripe and invoices by SuperFaktúra; they receive billing data only.