Platform
The page an auditor reads.
Autonomy is only sellable if it is explainable. Every action an agent takes is logged with the reasoning and the confidence behind it, and anything below your threshold waits for a person.
Approach
Layers, not a single certificate
Compliance here is risk-based and layered rather than resting on one audit. Adhering to security, privacy and data-management standards is treated as foundational to how the platform operates — which matters more than usual when the software is posting to your ledger rather than reporting on it.
Certifications
What we hold today
SOC 1 Type 2
Controls relevant to financial reporting. The examination speaks to transparency and accountability in financial processes and controls — the one your external auditor will ask about first.
SOC 2 Type II
Achieved under SSAE 18 from the AICPA, covering data security, confidentiality and availability.
ISO/IEC 27001:2013
The international standard for information security management, covering how security is governed rather than only how it is implemented.
ISO 27701
The privacy extension to ISO/IEC 27001, providing the framework for GDPR and other data-privacy requirements.
HIPAA
For customers in healthcare, supporting the strict regulations covering protection of patient data where it is in scope.
GDPR
Compliant with the European General Data Protection Regulation. Each data collection point is assessed for whether it is necessary at all.
Audit
Every decision carries its reasoning
A log entry is not “invoice posted”. It is what arrived, what the agent matched it against, the confidence it held, what it decided, and who approved it if a person was involved. That record is what makes the close defensible months later, when nobody remembers the invoice.
Action-level logging
Each step an agent takes is recorded against the document and the account it touched.
Confidence on the record
The score that drove the decision is stored with it, so a threshold change can be reasoned about after the fact.
Human approvals attributed
Where a person approved, edited or rejected, the record says who and when.
Data handling
Your data does not train shared models
Customer data is not used to train models shared with other customers. What the agents learn from your resolutions improves your deployment, not someone else’s. Personal data handling follows practices the team is trained on and maintains, and the cookies policy, privacy policy and terms of service are kept in step with those requirements.
Deployment
Start small without lowering the bar
The point of a layered posture is that a first process can go live quickly and scale later without the security position being renegotiated each time. Autonomy thresholds move; the controls underneath them do not.
The honest part
What a real audit will still ask you
Certifications tell an auditor the controls exist and were tested. They do not answer every question your risk team will raise — hosting region and data residency, encryption specifics, sub-processors, penetration-testing cadence, incident-response and recovery commitments. Those belong in a security questionnaire and a signed agreement rather than on a marketing page, and we would rather send you the current documents than publish a summary that ages badly. Ask, and you get them.
Questions
Asked before every deployment
Which security certifications does JIFFYAI FinOps hold?
SOC 1 Type 2, SOC 2 Type II under SSAE 18, ISO/IEC 27001:2013, ISO 27701, and HIPAA where protected health information is in scope. The platform is also compliant with the European General Data Protection Regulation.
Is our data used to train models for other customers?
No. Customer data is not used to train models shared across customers. What the agents learn from your resolutions improves your own deployment.
Is every AI decision auditable?
Yes. Each agent action is logged with the inputs it read, the confidence it held, the decision it made, and the approver where a person was involved.
Are you GDPR compliant?
Yes. The platform is designed with security considered up front, and each data collection point is assessed for necessity. ISO 27701, the privacy extension to ISO/IEC 27001, provides the supporting framework.
Where can we get your full security documentation?
Hosting and data residency, encryption detail, sub-processors, penetration-testing cadence and incident-response commitments are shared directly rather than published, so they stay current. Request them through your account contact or sales@jiffy.ai.
See it running before you decide.
The tour is the product, not a video of it. Walk the floor yourself — no form in front of it.