Security isn't a feature. It's the architecture.
justonce.ai was built from the ground up with privacy at its core. Your memory content is encrypted at rest under keys issued for you and for each space you share, and it is hosted in Australia. Who can read a memory is decided by who you shared it with. Internal access is role-restricted and audit-logged, and your memories are never used to train models.
How your data stays safe
In transit
Everything you send to justonce.ai travels over TLS 1.2 or higher — from the app, from your email-in address, and from every AI assistant connected over MCP.
Encrypted at rest
The title, summary and body of a memory are encrypted with AES-256-GCM — an authenticated cipher — before they are written to storage, and documents you upload are encrypted the same way. A limited number of older records created before we introduced this encryption are still being migrated to it; until then they are protected by our cloud provider’s storage-level encryption.
Keys issued for you
Your data is encrypted under a Data Encryption Key issued for you, and each shared space gets its own, so one key never covers everybody’s data. We generate and manage those keys on your behalf — you do not hold them.
Wrapped keys (KEK/DEK)
Every Data Encryption Key is itself encrypted by a master Key Encryption Key that we hold and manage, kept out of the database entirely. It can be rotated without re-encrypting your memories.
Access control
Membership of a space decides who can read the memories in it — that is the boundary, enforced on every request. Internal access is role-restricted and logged in an append-only audit trail.
Most AI memory systems paraphrase what you told them into a summary and keep it in the clear. justonce.ai keeps your words verbatim — and encrypts them at rest with AES-256-GCM under keys issued for you and for each space you share, on Australian infrastructure.
Defence in depth
AES-256-GCM encryption
Per-user and per-space keys
Key hierarchy (KEK/DEK)
Append-only audit logs
Encrypted document storage
Australian data residency
Sign-in secured by Auth0
We don't write our own login. Identity for justonce.ai runs on Auth0 — now part of Okta — in their Australian region, so the record of who you are stays in the same country as your memories. These are the settings we actually run.
No password to steal
You sign in with Google, with Microsoft, or with a one-time code sent to your email. justonce.ai never asks you to set a password, and there is no password of yours for us to store or lose.
Passkeys and security keys
Second factors are passkeys, WebAuthn security keys, or an authenticator app, with single-use recovery codes. SMS is deliberately switched off — it is the factor most exposed to SIM-swap.
Adaptive MFA
Every sign-in is risk-assessed, and a second factor is demanded when the attempt does not look like you — an unfamiliar device or location, or traffic matching a known attack pattern.
Brute-force lockout
Five failed attempts against the same identifier and IP block further tries and notify the account owner.
Rotating refresh tokens
Your session is held by a refresh token that rotates on every use, expires after 14 days, and dies after a day of inactivity — so a stolen token has a short, single-use life.
Signed, audience-bound tokens
The app is an OIDC-conformant public client using PKCE. Access tokens are RS256-signed and bound to the justonce.ai API audience, so a token minted for anything else is refused.
Checking Auth0 for yourself
Trusting us with your memories means trusting our identity provider too, so here is where to audit them directly rather than take our word for it. Okta publishes their certifications, their live availability, and an open bug bounty for Auth0.
Secured by Aikido
Our code, our dependencies and our cloud are scanned continuously by Aikido Security. Findings arrive with a severity and a fix deadline, and they go through the same branch, review and staging pipeline as every other change we ship. No software is free of vulnerabilities — what matters is whether someone is looking, and whether the clock starts when they find one.
Our own code
Static analysis on every push, looking for injection, XSS and unsafe handling in the code we write.
Open-source dependencies
Every package we depend on is watched for newly disclosed CVEs and malicious releases, with a fix deadline attached to each finding.
Leaked secrets
Commits and history are scanned for credentials that should never have been checked in.
Cloud configuration
Our Azure subscription is checked against misconfiguration — public exposure, weak access restrictions, drift from what we intended.
Our public surface
justonce.ai is probed from the outside the way an attacker sees it, including the headers the site actually serves.
Doing a security review?
We can send you our security report — the current posture of our code and cloud, generated from Aikido rather than written by our marketing team. Ask and we'll send it.
Where we stand
Ready to store your data securely?
Your privacy is not an afterthought. It's the foundation.