JumpCloud Compliance & Certifications 2026

Yes. JumpCloud has completed a SOC 2 Type 2 examination and achieved ISO 27001 certification for its open directory platform. The SOC 2 report is not a self-service download. You request it by emailing [email protected] and signing an NDA. These are the formally published certifications on its security page, so for other frameworks such as PCI, HIPAA or FedRAMP, confirm current status and scope directly with JumpCloud.

With encryption in transit and at rest. Across its authentication protocols, LDAP, RADIUS, SAML, plus the agent binding, JumpCloud encrypts traffic with TLS 1.2 and above and recommended cipher suites, including data between agents and its endpoints. All databases are encrypted at rest, and applications with sensitive data add best-practice ciphers. Infrastructure is highly available across availability zones and regions, with production services replicated and a degradation-before-disruption design.

Request the SOC 2 Type 2 report by emailing [email protected] and signing an NDA. The security program itself is documented. It runs continuous vulnerability scanning and external penetration tests at least yearly, folded into the development workflow. SAST and DAST sit in the build pipeline, with a Vulnerability Disclosure Program for researchers. The admin scripts and PowerShell module are also open source on GitHub, so the tooling is inspectable.

Through MFA and role-based access control that supports separation of duties, least privilege and audit. The agent enforces device-level controls, adding, modifying, deleting local accounts, running commands, and enabling SSH MFA on Linux. Directory Insights provides an audit trail and attributes agent installs to the admin who owns the Connect Key. Employees undergo background checks and annual security-awareness training, and the platform delivers SSO, MFA, Zero Trust and RADIUS across managed devices.

Confirm the ISO 27001 certificate scope covers the open directory platform components you deploy, and request the SOC 2 report under NDA to check scope and validity. Verify any framework beyond SOC 2 and ISO 27001 directly. Because the Connect Key is explicitly not a secret, and any key can connect the agent to a device, govern device onboarding accordingly. User keys expire in an hour, admin keys never expire. Finally, set up the administrator-verified GDPR data-deletion path for data subjects.