JumpCloud

What JumpCloud is and how it works

JumpCloud is an open directory platform that combines what used to be three separate categories: identity provider (similar to Okta or Azure AD), unified endpoint management (similar to Intune or Jamf) and access management (SSO, MFA, conditional access). IT teams use JumpCloud to centralise user provisioning across SaaS applications, enforce device posture before granting access and audit who accessed what and from where. JumpCloud is operated by JumpCloud Inc. (United States) and is widely deployed by small and mid market companies in EMEA.

What data JumpCloud processes

JumpCloud stores user directory attributes (name, email, role, department, manager, group memberships, password hash), MFA configuration, device inventory (hostname, OS, version, serial, OS patches), session data (login IP, geolocation inferred from IP, user agent, device used) and a complete audit log of all platform actions. Logs are retained for 90 days by default and can be extended to 1 year on higher tier plans.

GDPR and NIS2 implications

JumpCloud is a processor of employee personal data under GDPR. The customer (employer) is the controller and must document the processing in its record of processing activities, sign the JumpCloud DPA, and ensure employees are informed. NIS2 requires essential and important entities to implement multi factor authentication and access controls; JumpCloud is often the chosen tool, which makes its uptime and integrity directly relevant to NIS2 compliance. Cross border transfer to the US must be addressed via SCCs and a Transfer Impact Assessment, or by switching to the EU region.

Consent and legal basis

Because the data subjects are employees, the lawful basis is normally Art. 6(1)(b) (contract performance, employment) or Art. 6(1)(f) (legitimate interest in securing IT systems), not consent. Some EU member states require a works council consultation under Art. 88 GDPR before deploying workforce monitoring tools, especially when device posture and audit logs can profile employee behaviour. Employees do not need to give consent for JumpCloud to function, but they must be informed.

Data residency and US transfers

JumpCloud defaults to US hosting (AWS us-east). At signup or by migration, customers can choose the EU region (AWS Frankfurt), which keeps all directory and audit data in the EU. Use the EU region for European customers when feasible. For the US region, transfers rely on SCCs and on the EU, US Data Privacy Framework where JumpCloud is certified. Run a Transfer Impact Assessment and document the technical and organisational measures (encryption at rest, in transit, customer managed keys for sensitive customers).

Practical compliance steps

Sign the JumpCloud DPA, choose the EU region when possible, run a Transfer Impact Assessment if you must use US, document JumpCloud in your record of processing activities, inform employees via the internal privacy notice, consult the works council where required, set audit log retention to align with your legal needs and security policy, enable MFA for admins, restrict console access by IP, and integrate JumpCloud audit logs into your SIEM for detection and incident response.