Privacy policy
Last updated 9 October 2026
Who we are
JARIS AI is provided by JARIS Labs, United Kingdom ("we"). Questions about this policy or your data: support@jarislabs.co.uk.
JARIS processes information about your organisation's users and devices on behalf of your organisation, which decides what JARIS is connected to and who may use it. For that information your organisation is the controller and JARIS Labs is its processor. For your own sign-in to JARIS, JARIS Labs is the controller.
Where your data is
Each organisation has its own dedicated JARIS server, not shared with any other customer, hosted by Hostinger in a data centre in the United Kingdom. Connections use HTTPS.
What JARIS collects
- Your sign-in. When you sign in with Google or Microsoft, JARIS receives your name, email address and profile picture link, and keeps a sign-in session cookie (see Cookies). JARIS never sees your password. Sign-ins are recorded in the server log with your email address and provider.
- Microsoft 365 data, only if your organisation connects Microsoft, through read-only permissions it approves: user accounts (names, email addresses, account status), administrator role assignments, multi-factor authentication registration and sign-in method summaries, risky-user reports, Secure Score, Conditional Access and Intune device policies, managed devices, and Microsoft Defender devices and vulnerabilities. JARIS reads this when a page needs it. It can't change anything in your tenant.
- Device information from the JARIS Agent, only on devices your organisation installs it on: device name, operating system and version, network addresses, installed software, security settings (antivirus, firewall, disk encryption, updates, local administrators), running processes, listening network ports, and how many passkeys each signed-in user has. This is stored on your organisation's JARIS server.
- Reports. Scheduled report snapshots keep figures and vulnerability identifiers over time, without device names.
JARIS Chat and AI providers
If your organisation connects an AI provider (Anthropic, OpenAI, Google or GitHub), the questions you ask in JARIS Chat, and the context JARIS adds to them, are sent to that provider to produce an answer, under the provider's own terms. Your chat history is kept in your own browser, not on the JARIS server.
Other services JARIS uses
- To assess vulnerabilities, JARIS looks up software names and versions and vulnerability identifiers with Microsoft's Security Update Guide, OSV.dev, the US National Vulnerability Database, CISA and FIRST. No personal data is sent.
- Pages load the Inter typeface from Google Fonts and two small libraries from the jsDelivr network, so those services see your IP address when you open JARIS.
Cookies and browser storage
JARIS uses one cookie, jaris_session, which keeps you signed in. It's strictly necessary, can't be
read by scripts, and expires after your session (12 hours by default). Your browser also stores preferences such as
the light or dark theme, your chat history and text you paste into the IOC Workbench. They stay on your device, and
clearing your browser data removes them. JARIS uses no analytics, advertising or tracking cookies.
How long data is kept
- Microsoft 365 data is read when needed and not kept, apart from short-lived caches and the report figures described above.
- Device information is kept while the device is enrolled in JARIS, and removed when it is removed.
- Nightly backups of the server's settings and data, readable only by the server's administrator account, are kept for 14 days.
- When your organisation stops using JARIS, its dedicated server and backups are deleted.
Security
A dedicated server for each organisation, HTTPS, a firewall, read-only Microsoft permissions that JARIS refuses to connect without, credentials held only on the server, sign-in limited to people your organisation approves, and deploy access that can only install reviewed updates.
Your rights
Under UK data protection law you can ask to access, correct or delete your personal data, or object to how it's used. Because JARIS acts for your organisation, please contact your organisation's administrator first. You can also write to support@jarislabs.co.uk, and you can complain to the Information Commissioner's Office (ico.org.uk).
Changes
We'll update this page when JARIS changes how it handles data, and change the date at the top.