Security & Compliance

Jerbz implements a multi-layered, zero-trust cloud architecture to keep client data secure.

1. API Client Attestation

We enforce Firebase App Check integrated with reCAPTCHA Enterprise. This guarantees that only valid, untampered versions of the official Jerbz web client can access our Cloud Run APIs and Firestore nodes, preventing automated bot or script-based abuse.

2. Lifecycle Hook Authorization

Google Cloud Procurement API events are delivered to our listener endpoint using secure GCP Pub/Sub subscriptions. Every payload is signed with Google-signed OIDC Identity Tokens, which are verified cryptographically before processing subscription status updates.

3. Zero Hardcoded Credentials

All system secrets, SMTP certificates, database access tokens, and API client keys are stored in GCP Secret Manager. Jerbz instances fetch these variables on-demand at startup using dedicated service accounts with IAM Least-Privilege access.

4. Cloud-Native Hosting and Encryption

Our infrastructure is hosted 100% on Google Cloud Platform. Data is encrypted in transit using TLS 1.3 and at rest inside Google Cloud Firestore using AES-256 keys managed by Google. Compute workloads execute in sandbox containers under Cloud Run.