Security

Our Commitment to Security

JohnnyHQ is built around trust.

Property owners use JohnnyHQ to organize important information, evaluate Contractors, upload project documents, and make significant financial decisions. Protecting that information is fundamental to our mission.

Johnny Labs, LLC, doing business as JohnnyHQ ("JohnnyHQ," "Johnny," "Company," "we," "our," or "us"), is committed to implementing commercially reasonable administrative, technical, and organizational safeguards designed to protect the confidentiality, integrity, and availability of the information entrusted to us.

Security is an ongoing commitment rather than a one-time achievement. As the Platform grows, we continually evaluate and strengthen our security practices to address evolving threats, technologies, and industry standards.

1. Our Security Principles

JohnnyHQ's security program is guided by several core principles.

We strive to:

• protect User information from unauthorized access;
• collect only the information reasonably necessary to provide the Services;
• design security into our products from the beginning;
• continually improve our security practices;
• monitor for threats and suspicious activity;
• respond promptly to security incidents;
• work with trusted technology providers; and
• provide Users with practical guidance to help protect their own Accounts.

Security is incorporated into the design, development, deployment, and operation of the Services.

2. Protecting Your Information

JohnnyHQ employs multiple layers of security designed to help protect User information throughout its lifecycle.

Depending on the Services being used, these measures may include:

• encrypted communications;
• authenticated user sessions;
• secure cloud infrastructure;
• role-based access controls;
• infrastructure monitoring;
• security logging;
• automated backups;
• disaster recovery procedures;
• software updates;
• vulnerability remediation;
• fraud detection;
• and other commercially reasonable safeguards appropriate to the nature of the Services.

Because security technology and threats continue to evolve, the specific measures implemented by JohnnyHQ may change over time as we improve the Platform.

3. Account Security

Protecting User Accounts is an important part of JohnnyHQ's overall security program.

JohnnyHQ uses commercially reasonable authentication and access control measures designed to help protect Accounts from unauthorized access.

Depending on the Services being used, these measures may include:

• secure authentication mechanisms;
• encrypted session management;
• account verification processes;
• automatic session expiration where appropriate;
• suspicious activity monitoring;
• login security protections; and
• other security controls designed to help protect User Accounts.

Users also play an important role in protecting their own Accounts.

We encourage Users to:

• choose strong, unique passwords;
• protect login credentials;
• avoid sharing Accounts with others;
• use secure devices and networks;
• promptly report suspected unauthorized access; and
• keep account recovery information current.

Protecting your Account is a shared responsibility between JohnnyHQ and each User.

4. Artificial Intelligence Security

Artificial intelligence is a core component of JohnnyHQ, and protecting AI-powered workflows is an important part of our overall security approach.

JohnnyHQ designs its AI Services with consideration for security, privacy, and responsible operation.

Depending on the functionality being used, JohnnyHQ may implement measures intended to:

• securely process AI requests;
• authenticate requests submitted to AI Services;
• maintain conversation integrity;
• protect uploaded documents during processing;
• monitor for abusive or malicious use;
• reduce unauthorized access to AI systems;
• support secure communication between AI components; and
• improve the overall reliability and safety of AI-powered features.

Because artificial intelligence technologies continue to evolve rapidly, JohnnyHQ continuously evaluates new approaches to improving the security of AI interactions while balancing usability, privacy, and performance.

5. Cloud Infrastructure

JohnnyHQ relies on trusted cloud infrastructure and technology providers to help deliver the Services.

Depending on the Services being used, information may be processed or stored using professionally managed cloud environments that incorporate security controls designed to protect customer information.

JohnnyHQ carefully evaluates the providers we use and seeks to work with organizations that maintain strong operational and security practices appropriate for the services they provide.

As our Platform grows, our infrastructure and security architecture will continue to evolve to support increasing reliability, scalability, and protection of User information.

6. Monitoring and Threat Detection

JohnnyHQ continually monitors the health, performance, and security of the Services.

Monitoring activities may include:

• infrastructure monitoring;
• application monitoring;
• error reporting;
• performance monitoring;
• system logging;
• security event monitoring;
• fraud detection;
• abuse detection;
• service availability monitoring; and
• other operational monitoring designed to help maintain the reliability and security of the Platform.

Monitoring helps JohnnyHQ identify potential issues, investigate unusual activity, improve system reliability, and respond to security concerns in a timely manner.

7. Third-Party Security

JohnnyHQ works with carefully selected third-party service providers to help operate the Platform.

These providers may support services such as:

• authentication;
• cloud hosting;
• payment processing;
• communications;
• analytics;
• artificial intelligence;
• mapping;
• customer support; and
• other operational functions.

JohnnyHQ evaluates third-party providers before integrating them into the Platform and seeks to work with organizations that demonstrate appropriate security practices.

Although we strive to partner with trusted providers, each third party maintains its own security practices and policies, and JohnnyHQ cannot guarantee the security of systems that it does not own or control.

8. Security by Design

JohnnyHQ follows a security-by-design philosophy.

We believe security should be incorporated into the planning, design, development, testing, deployment, and ongoing operation of the Services rather than treated as a separate or after-the-fact consideration.

As new features are developed, JohnnyHQ seeks to evaluate security alongside usability, privacy, accessibility, reliability, and overall product quality.

While no software system can eliminate every security risk, integrating security considerations throughout the product development lifecycle helps us build more resilient and trustworthy Services over time.

Security-by-design is an ongoing practice that continues to evolve alongside our Platform, technology, and the changing cybersecurity landscape.

9. Security Incident Response

Despite commercially reasonable safeguards, no technology platform can guarantee absolute protection against every security threat.

JohnnyHQ maintains processes designed to help identify, investigate, respond to, and recover from security incidents affecting the Services.

If JohnnyHQ becomes aware of a security incident involving Personal Information, we will investigate the incident and, where required by applicable law, notify affected Users and appropriate governmental authorities within the timeframes required by law.

Our response to a security incident may include:

• investigating the nature and scope of the incident;
• containing and mitigating potential impacts;
• restoring affected services where appropriate;
• implementing corrective measures;
• communicating with affected Users when required by law; and
• evaluating opportunities to improve future security practices.

Every security incident provides an opportunity to strengthen the Platform and improve our overall security posture.

10. Responsible Disclosure

JohnnyHQ appreciates the efforts of security researchers and members of the security community who responsibly identify potential security vulnerabilities.

If you believe you have discovered a security vulnerability affecting JohnnyHQ, we encourage you to report it responsibly by contacting us before publicly disclosing the issue.

When reporting a potential vulnerability, please provide sufficient information to help us understand and reproduce the issue.

JohnnyHQ will review responsible disclosures in good faith and will make reasonable efforts to investigate reported vulnerabilities.

We ask that researchers:

• avoid accessing information that does not belong to them;
• avoid disrupting the availability of the Services;
• avoid modifying User data;
• avoid violating applicable law;
• provide reasonable time for investigation and remediation before public disclosure; and
• cooperate in good faith throughout the disclosure process.

Responsible disclosure helps improve the security of the Platform for everyone.

11. Continuous Improvement

Security is an ongoing commitment rather than a fixed destination.

As JohnnyHQ continues to grow, we expect our security practices, infrastructure, technologies, and internal processes to evolve alongside the Platform.

We regularly evaluate opportunities to improve:

• infrastructure security;
• application security;
• AI security;
• authentication;
• monitoring;
• privacy protections;
• operational resilience;
• vendor management;
• employee security practices; and
• overall platform reliability.

As appropriate, JohnnyHQ may adopt additional security technologies, conduct independent security assessments, pursue recognized security certifications, or implement other measures that strengthen the protection of the Services and User information.

12. Our Security Commitment

JohnnyHQ was built to help property owners make more informed and confident decisions.

That mission depends upon trust.

We recognize that Users entrust JohnnyHQ with important information relating to their homes, Projects, documents, and property decisions. Protecting that information is fundamental to maintaining that trust.

While no platform can guarantee absolute security, JohnnyHQ is committed to continuously improving our security practices, responding thoughtfully to emerging threats, and designing the Services with security, privacy, and reliability as foundational principles.

Security is not a feature we add to JohnnyHQ.

It is a principle that guides how we build it.

Contact Us

If you have questions regarding JohnnyHQ's security practices or would like to responsibly report a potential security concern, please contact:

Johnny Labs, LLC
Doing Business As: JohnnyHQ

Email: josh@johnnyhq.com

Until a dedicated security email address is established, security-related inquiries may also be sent to:

josh@johnnyhq.com

Website: https://johnnyhq.com