Card data never touches our servers
Payments are processed by Stripe. Card numbers are entered directly into Stripe’s systems, so JUMP never stores or transmits them — the SAQ-A model.
Security
How we protect your data and payments
Security isn’t a launch checkbox for a staffing marketplace — it’s the product. Here’s how JUMP handles payments and data.
Encrypted in transit and at rest
All traffic is served over HTTPS/TLS, and data is encrypted at rest in our cloud infrastructure.
Signed in with a second factor, and recorded
Signing in to our support console requires a one-time code as well as a password. Reads made through the support console are recorded — who looked, at whose record, and when.
Payments & PCI
JUMP uses Stripe to process all employer payments. Because card details are captured directly by Stripe and never pass through or rest on JUMP’s servers, JUMP falls under the simplest PCI scope (SAQ-A). Stripe is a PCI-DSS Level 1 certified service provider.
Data protection
Traffic between your device and JUMP is encrypted with TLS. Data is encrypted at rest in our cloud infrastructure.
Operator sign-in requires a second factor. An account that can reach the support console must have an authenticator app enrolled; without one, no session is issued at all, so the requirement cannot be skipped by going around the console. There is one exception, and it exists so the rule can be met at all: while a newly invited operator still holds the temporary password we sent them, they can sign in without a code, which is how they set their own password and enrol an authenticator app. From the moment that is done, sign-in without a code is refused.
Reads made through the support console are recorded. When a member of our team opens a worker's record through the console, that is written to an append-only log holding who looked, whose record, which screen and when. The log is kept for 400 days, and there is no operation anywhere in our software that can edit or delete an entry in it.
An employer sees a worker's details only through an application that worker made, and only a fixed short list of fields: name, profile photo, average rating, number of ratings, chosen job categories, skills, and years of experience. There is no directory of workers for employers to browse, and the résumé file a worker uploads is never shared with an employer.
Workers and employers can delete their account from inside the app. That removes the account and the personal data attached to it; what has to be kept, and why, is set out in our privacy policy.
Backups. We take a daily backup kept for 35 days and a monthly backup kept for 365 days, so we can recover from a failure or a mistake. A backup is never used to bring back an account that asked to be erased.
Responsible disclosure
If you believe you’ve found a security vulnerability, please email support@jumpco.co with the details. We welcome good-faith reports and will respond as quickly as we can.
A note on scope
JUMP is in early access, and our formal security and compliance program is being built out alongside the product. This page describes our current practices in plain language; it is not a certification or an audit report. For specific security or compliance documentation, contact us at support@jumpco.co.