How Jumaah protects your data

This page is a draft under legal review: it describes the service as it works today, and the reviewed wording will replace it.

Jumaah holds mosques’ sermons and their teams’ accounts, so protection is built into how the service works. This page describes those measures as they are today; it is not a certification.

Accounts and sign-in

Passwords are stored only as scrypt hashes, never in readable form. Sign-in attempts are rate-limited, and repeated wrong passwords on one account send its holder an alert.

A second factor, a code from an authenticator app, is required for platform administrators and available to every user. In the browser, the sign-in token is kept in a cookie that page scripts cannot read, and any session can be ended at once: by signing out other devices, by changing the password, or by an administrator.

Sensitive actions ask you to confirm who you are again, among them restoring a backup, changing translation-provider keys, deleting a user or a mosque, and transferring ownership.

Keeping mosques apart

Each mosque’s data is kept apart by the application on every request: a user’s mosque is taken from their sign-in, never from what the request says, and every query is limited to that mosque. Automated tests try each route with another mosque’s records and expect nothing back.

When platform staff open a mosque’s account, it is written to that mosque’s audit trail. Acting as a mosque administrator needs a written reason, lasts at most thirty minutes, and every administrator of the mosque is notified.

Data and changes

Traffic is encrypted in transit with TLS, and translation-provider keys and second-factor secrets are encrypted at rest and never shown back in full. Every change is recorded in an audit trail, with who, what, before, after and when, which the application cannot edit or delete.

Backups and export

A mosque administrator can take a backup of the mosque’s content at any time, download it, and restore it; a restore asks for confirmation again. A mosque’s backups are reachable only by that mosque, through short-lived signed links, and the mosque can export its data at any time.

Reporting a vulnerability

If you find a security weakness, write to us through the contact page and choose the topic “Security report”. Tell us what you found and how to reproduce it, and please do not access other people’s data or disrupt the service. We will acknowledge your report, keep you informed, and ask for reasonable time to fix the issue before it is disclosed.