jfrog.com
A
85 of 100
Enterprise AI readiness, from public pages only
Scanned 2026-11-01 from 100 public pages. Methodology 1.0. Category: Developer tools.
| Identity | 20 of 20 | |
| Assurance | 25 of 25 | |
| Data and AI terms | 8 of 21 | |
| Deployment | 6 of 6 | |
| Agent readiness | 17 of 17 |
Trend and peers iHow the score moved over the last scans, how it compares with other scored companies in the same market category, and what about the last scan means the score may still move. Everything comes from public pages.
One graded scan so far. The trend shows after the next one.
Peers
| Category | This company iThis company's score in the category at its latest graded scan. | Peer median iThe middle score among other listed companies in the same market category, at their latest graded scans under the current methodology. | At or above iThe share of those peers this company scores at or above. |
|---|---|---|---|
| Total | 85 | 87.5 | 50% |
| Identity | 100 | 100 | 100% |
| Assurance | 100 | 96 | 100% |
| Data and AI terms | 38 | 79.5 | 17% |
| Deployment | 100 | 100 | 100% |
| Agent readiness | 100 | 92 | 100% |
Likely to change iWhat about the last scan means the score may still move: checks that could not be read, findings waiting for review, an old scan, an older methodology, or a scan that hit its page limit. These describe the scan, not the company.
- 3 checks could not be read at the last scan, so the score may move when they are read.
- 1 finding is waiting for staff review.
- The last scan stopped at its page limit, so some pages were not read.
Identity
SAML or OIDC single sign-on (10 points) Found
Manage users and groups at scale with OOTB identity management integrations using SAML and SCIM.
source
SCIM provisioning (6 points) Found
Manage users and groups at scale with OOTB identity management integrations using SAML and SCIM.
source
Roles and permissions (4 points) Found
Manage granular RBAC permissions for full control over access and interactions platform-wide.
source
Assurance
Trust center (5 points) Found
Contact: mailto:security@jfrog.com
source
security.txt (2 points) Found
Contact: mailto:security@jfrog.com
source
Bug bounty or disclosure program (2 points) Found
Security researchers may be able to participate in a bug bounty program and earn rewards for their findings.
sourcePlease submit your security report through the form below - it will lead to the private bug bounty program managed by HackerOne.
sourcePlease note that you must be logged in to the HackerOne platform when submitting the report.
source
Data and AI terms
No training on customer data (8 points) Not found in public pages
Pages searched (13)
https://jfrog.com/ai/https://jfrog.com/terms-of-use/https://jfrog.com/privacy-notice/https://jfrog.com/privacy-notice/https://jfrog.com/privacy-and-security/https://jfrog.com/terms-and-conditions/https://jfrog.com/acceptable-use-policy/https://jfrog.com/fr/terms-of-use/https://jfrog.com/de/terms-of-use/https://jfrog.com/fr/ai/https://jfrog.com/ja/terms-of-use/https://jfrog.com/de/ai/https://jfrog.com/ja/ai/
Retention periods (5 points) Not found in public pages
Pages searched (2)
https://jfrog.com/ai/https://jfrog.com/terms-of-use/
Subprocessor list (5 points) Under review
Data processing agreement (4 points) Found
Data residency (4 points) Found
Customers choose their hosting location.
source
Deployment
Private deployment (6 points) Found
Customer-managed keys (4 points) Could not check
The scan reached its page or time limit before reading the pages this check needs.
Agent readiness
Public API reference (5 points) Found
JFrog Artifactory prior to version 7.29.8 and 6.23.38is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in the Users REST API endpoint.
source
Official MCP server (6 points) Found
Controls on AI agent actions (4 points) Found
Audit log export (2 points) Could not check
The scan reached its page or time limit before reading the pages this check needs.
AI use policy (2 points) Found
AI features are customer-controlled and AI development is governed by JFrog's Data Strategy and AI Legal Group.
source
Rate limits documented (not scored) Could not check
The scan reached its page or time limit before reading the pages this check needs.
Changelog
- 2026-11-01: 100 to 85 (rescan) AI use policy: Could not check to Found; Official MCP server: Could not check to Found; No training on customer data: Could not check to Not found in public pages; Data residency: Could not check to Found; Retention periods: Could not check to Not found in public pages
- 2026-11-01: First score, 100
Scores older than an hour can be refreshed.