Public API

A public, read-only API for automated DDQ and vendor-assessment tools. Pull our certifications, sub-processors, document catalog, and verify document integrity programmatically.

A machine-readable OpenAPI 3.0 specification is available: Download openapi.yaml →

Getting started

No authentication. All endpoints are public and require no API key or token.
CORS enabled. Every response sends Access-Control-Allow-Origin: * so calls work from any browser origin.
Rate limits. The certifications, sub-processors, and documents endpoints allow 60 requests per IP per hour. The verify endpoint allows 10 requests per IP per minute. Exceeding a limit returns 429 with a Retry-After header.
Base URL. https://trust.jiffy.ai

Endpoints

GET/api/v1/public/certifications

Current certifications and audit status (ISO 27001, SOC 2, HIPAA, GDPR, ISO 42001, etc.).

Rate limit: 60 requests / IP / hour

Example response

{
  "last_updated": "2026-06-25",
  "certifications": [
    {
      "id": "iso27001",
      "name": "ISO/IEC 27001:2022",
      "type": "certification",
      "status": "active",
      "valid_through": "2027-06-30",
      "description": "Information security management certification"
    },
    {
      "id": "soc2",
      "name": "SOC 2 Type II",
      "type": "audit",
      "status": "active",
      "report_period": "2025",
      "description": "Annual SOC 2 Type II examination"
    }
  ]
}

GET/api/v1/public/sub-processors

Third-party sub-processors that may process customer data, with category, activity, and country (ISO 3166-1 alpha-2).

Rate limit: 60 requests / IP / hour

Example response

{
  "last_updated": "2026-06",
  "sub_processors": [
    {
      "entity": "Amazon Web Services",
      "category": "Cloud Infrastructure",
      "activity": "Cloud hosting, compute, databases, storage, and networking",
      "country": "US",
      "website": "aws.amazon.com"
    },
    {
      "entity": "Anthropic, PBC",
      "category": "AI & Machine Learning",
      "activity": "Large language model inference (Claude) via AWS Bedrock",
      "country": "US",
      "website": "anthropic.com"
    }
  ]
}

GET/api/v1/public/documents

Catalog of currently published trust documents. Returns metadata only — no download URLs or storage keys are exposed. Tier is one of "public", "nda", or "restricted". Append ?tier=public for a public-only catalog.

This endpoint returns metadata (name, category, tier, dates) for all documents in the catalog, including NDA and Restricted tiers. Download URLs and file content are never returned for NDA/Restricted documents. If you require a filtered catalog (public tier only), append ?tier=public to the request.

Rate limit: 60 requests / IP / hour

Example response

{
  "documents": [
    {
      "id": "clx123abc",
      "name": "SOC 2 Type II Report",
      "category": "Audit Reports",
      "tier": "nda",
      "last_updated": "2026-05-12"
    },
    {
      "id": "clx456def",
      "name": "Information Security Policy",
      "category": "Policies",
      "tier": "public",
      "last_updated": "2026-03-01"
    }
  ],
  "total": 2
}

GET/api/v1/public/verify?hash=<sha256>

Verify the integrity of a downloaded document by its SHA-256 hash. Returns whether the hash matches a known published document.

Rate limit: 10 requests / IP / minute

Example response

{
  "verified": true,
  "document_name": "SOC 2 Type II Report 2025",
  "issued_at": "2026-06-23T00:00:00.000Z",
  "version": "1.0",
  "issuer": "JIFFYAI Trust Center"
}

API Stability

This API is currently at v1. We will not make breaking changes to existing endpoints without at least 90 days notice via:

An entry in the changelog below
An email to all verified Trust Center subscribers

Changelog

Date	Change
June 2026	v1 launched with 4 public endpoints

Questions about the API or need higher rate limits for an integration? Contact ciso@jiffy.ai or use the Request Access flow.