What are Jolly's security and data privacy practices?

Jolly encrypts data when it moves, using TLS 1.2 or higher. Encrypted means locked so others cannot read it.

Jolly encrypts employee data, transaction records and organization data when it is stored, using AES-256.

Admins only see what their role allows. Jolly logs all admin activity for audits.

Jolly employees see customer data only when their work needs it.

Jolly is SOC 2 Type II certified and audited every year. An outside group does the audit.

Jolly is designed to support GDPR (in the EU), CCPA (in California) and other privacy laws.

Jolly runs regular penetration tests and vulnerability assessments. Critical fixes go out as needed.

Jolly hosts customer data in the United States. If you have specific data location needs, please contact your account manager.

Employee data is logically isolated to your dedicated Jolly environment, which means it is kept apart from other clients. Jolly shares no employee data across client accounts.