generated: '2026-07-19'
method: searched
source: https://jam.dev/docs/security, https://trust.jam.dev/, https://mcp.jam.dev/.well-known/oauth-authorization-server, https://jam.dev/docs/webhooks
standards:
  - id: soc2-type2
    conforms: true
    evidence: SOC 2 Type II compliant with annual audits and quarterly vulnerability assessments (trust.jam.dev, docs/security)
  - id: iso-27001
    conforms: true
    evidence: Listed on the Jam trust center (trust.jam.dev)
  - id: gdpr
    conforms: true
    evidence: GDPR compliance documented on docs/security
  - id: hipaa
    conforms: false
    evidence: Documented as "coming soon"
  - id: oauth2
    conforms: true
    evidence: MCP server + CLI use OAuth2 authorization_code with PKCE (S256); RFC 8414 metadata published
  - id: rfc8414-oauth-metadata
    conforms: true
    evidence: /.well-known/oauth-authorization-server served on mcp.jam.dev
  - id: rfc9728-oauth-protected-resource
    conforms: true
    evidence: /.well-known/oauth-protected-resource served on mcp.jam.dev
  - id: standard-webhooks
    conforms: true
    evidence: Webhook deliveries signed per standardwebhooks.com (Svix), svix-signature HMAC-SHA256
  - id: mcp
    conforms: true
    evidence: Hosted Model Context Protocol server at mcp.jam.dev/mcp exposing 22 tools
compliance:
  program_url: https://trust.jam.dev/
  certifications: [SOC 2 Type II, ISO 27001, GDPR]