{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "jumio", "name": "Jumio", "vendor": "Jumio Corporation", "vendorUrl": "https://www.jumio.com", "kind": "http-api", "category": "identity-verification", "summary": "Identity verification service from Jumio Corporation in Sunnyvale. It checks identity documents and selfies with liveness, screens against sanctions and PEP lists, and runs government database checks. Transactions are started and read through regional REST APIs with OAuth2.", "url": "https://www.anchorterminal.com/tools/jumio", "markdownUrl": "https://www.anchorterminal.com/tools/jumio.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/jumio.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/jumio.json", "repo": "https://github.com/Jumio/mobile-sdk-android", "license": "Proprietary service. No public service agreement was found. The @jumio/websdk npm package is marked UNLICENSED", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@jumio/websdk" }, { "registry": "npm", "name": "react-native-jumio-mobilesdk" } ], "auth": "oauth", "authNotes": "Sales approval. A Jumio account manager activates OAuth2 for the tenant and supplies the workflow keys. An admin then generates client ID and secret pairs in the Jumio Portal, each limited to initiating transactions, to retrieving and deleting them, or both, and each can be deactivated. The pair is sent as Basic credentials to the regional token URL with `grant_type=client_credentials`, and the bearer token lasts 60 minutes. Basic authentication on the REST APIs themselves is marked deprecated. Account creation also returns per-transaction tokens for uploads and the capture SDKs.", "pricing": "paid", "pricingNotes": "No public prices. www.jumio.com/pricing/ returns 404 and the site's Get Started button opens a sales enquiry form. No free tier, trial or self-serve signup was found. The mock service for synthetic test transactions needs a dedicated tenant that Jumio Support or the account manager sets up (checked 2026-10-08).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms-full.txt, the five OpenAPI files or the Jumio website (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 72, "npmWeekly": 2122, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://documentation.jumio.ai", "llmsTxt": "https://documentation.jumio.ai/llms.txt", "openapi": "https://documentation.jumio.ai/redocusaurus/account.yaml", "capabilities": [ "kyc.identity", "kyc.documents", "kyc.screening" ], "tags": [ "hosted", "enterprise", "oauth", "openapi", "llms-txt", "callbacks", "sales-led", "status-page", "soc2", "iso27001", "java", "dotnet" ], "lastRelease": "2026-09-28", "graded": true, "anchor": { "graded": true, "score": 55, "grade": "C", "agentReady": false, "rank": 521, "ranked": true, "rankOf": 722, "categoryRank": 8, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 45, "maintenance": 75, "payments": 0, "reliability": 65, "schema": 73, "security": 63, "transparency": 60 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 65, "points": 13, "reason": "Graded on the Platform REST APIs with the hosted lines. Statuspage at monitor.jumio.com with 48 components by data centre, plus an unauthenticated health endpoint per region (20). In the 90 days to 8 October 2026 there were four degradations of processing, on 14 to 15 August (about 20 hours, mainly the EU), 30 September and twice on 1 October (the second ran 13.5 hours), each causing delays and unexpected MISSING_MANDATORY_DATAPOINTS rejections, and a 35-minute outage of the Singapore data centre on 2 September that Jumio marked critical. No core API was down for an hour, so we scored between the minor and major lines (12). Limits are published per tenant, 10 token requests, 1 new transaction and 15 retrievals a second (15). A 429 with a JSON body is documented, with a retrieval retry schedule from 40 to 940 seconds and general backoff advice. No Retry-After header or idempotency key was found (8). No SLA found in public pages (0). GA (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "Five OpenAPI 3.0 files download from the reference pages, covering 25 operations across Accounts, Credentials, Retrieval, Aggregate and Public Status (25). llms.txt and a 2.2 MB llms-full.txt in Markdown, and robots.txt lists both (10). Operations carry a summary and a link to a guide, and the guides explain order of use. Few say when not to use an endpoint (12). String lengths, patterns, UUID formats and 57 enums in the Retrieval spec, but `overrideSettings` is a free-form object and the mock service packs JSON into `customerInternalReference` (11). Request and response examples throughout, and decision labels in tables. The specs list only 401, 403 and 404, with 400 and 429 described in prose (9). Paths carry /api/v1 and the specs are versioned 1.0.0, 1.0.2 or v0. No changelog for the REST APIs was found, only undated SDK changelogs (6)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 45, "points": 7.31, "reason": "No field selection. The workflow details response is large, though separate status, steps and rules endpoints return smaller ones (12). GET /api/v1/workflow-executions returns the last processed transactions and its spec has no paging or filter parameters (5). The 429 body has title, status and detail, and capability decisions carry documented labels. HTTP errors in the specs stop at 401, 403 and 404 (12). No idempotency key, and POST or PUT on accounts starts a new transaction each time. Reads are safe to repeat (5). An account request needs only `customerInternalReference` and a workflow key, plus a required User-Agent header. Official server libraries exist for Java Spring Boot and .NET, the first from Jumio's own Maven repository and the second as a download (11)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 63, "points": 11.03, "reason": "OAuth2 client credentials with 60-minute bearer tokens. Each client is limited to initiate, to retrieve and delete, or both, and can be deactivated. The Retrieval spec names a `transactions/retrieval` scope. No secret expiry or rotation procedure was found beyond generating a new pair (26). An initiate-only client can't read results, but reading and deleting share one permission and no confirmation step exists for DELETE (10). Responses carry text extracted from documents and watchlist results, with no injection guidance found (3). The Portal Audit Log records user actions with email, IP address and result since 1 September 2023. It isn't stated to cover API calls (9). SOC 2, ISO 27001 and PCI DSS 4.0.1 on the Trust Centre and an unpaid vulnerability disclosure programme. No bug bounty, and security.txt returns 404 (15)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 0, "points": 0, "reason": "No x402, MPP or L402 (0). No price is published. The pricing URL returns 404 and the site sends buyers to a sales form (0). No free tier or trial was found, and the mock service needs a tenant set up by Jumio (0). OAuth2 is activated by an account manager, so no agent can onboard alone (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 75, "points": 6.56, "reason": "Android SDK 4.19.1 was tagged on 28 September 2026 (30). Releases in the last 90 days include Android 4.18.0 on 10 July, 4.19.0 on 17 September and 4.19.1, iOS 4.19.0 on 18 September, and @jumio/websdk 0.6.1 and 0.6.2 on 21 July and 19 August (20). Closed service with public SDK changelogs and a support portal at support.jumio.com. No API changelog or public developer forum was found, and GitHub issue handling wasn't read (8). Capture SDKs are current. The Java client is 1.1.0 from a private Maven repository with no date, and the .NET library is a download (12). The public repositories hold docs and samples, with no CI visible, and @jumio/websdk is still 0.x (5)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 60, "points": 5.25, "note": "editorial 41, provenance 78", "reason": "Closed service with no public service agreement or API terms. The terms of use page covers end users in the United States (8). The Online Services Privacy Notice, updated 4 August 2026, says Jumio is the controller in general and the processor for certain customers, uses data to improve its services through machine learning, and destroys biometric data within three years. Other retention periods are available on request, and no public DPA was found. The docs say tenant retention is set through support (15). The SDK maintenance policy gives 9 months of support, 24 months to end of life and 3 months' notice of an earlier end. Basic authentication is marked deprecated with no date, and no policy for the REST APIs was found (12). Three data centre regions are named, and the list of third parties is available on request only (6)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "No field selection. The workflow details response is large, though separate status, steps and rules endpoints return smaller ones (12). GET /api/v1/workflow-executions returns the last processed transactions and its spec has no paging or filter parameters (5). The 429 body has title, status and detail, and capability decisions carry documented labels. HTTP errors in the specs stop at 401, 403 and 404 (12). No idempotency key, and POST or PUT on accounts starts a new transaction each time. Reads are safe to repeat (5). An account request needs only `customerInternalReference` and a workflow key, plus a required User-Agent header. Official server libraries exist for Java Spring Boot and .NET, the first from Jumio's own Maven repository and the second as a download (11).", "maintenance": "Android SDK 4.19.1 was tagged on 28 September 2026 (30). Releases in the last 90 days include Android 4.18.0 on 10 July, 4.19.0 on 17 September and 4.19.1, iOS 4.19.0 on 18 September, and @jumio/websdk 0.6.1 and 0.6.2 on 21 July and 19 August (20). Closed service with public SDK changelogs and a support portal at support.jumio.com. No API changelog or public developer forum was found, and GitHub issue handling wasn't read (8). Capture SDKs are current. The Java client is 1.1.0 from a private Maven repository with no date, and the .NET library is a download (12). The public repositories hold docs and samples, with no CI visible, and @jumio/websdk is still 0.x (5).", "payments": "No x402, MPP or L402 (0). No price is published. The pricing URL returns 404 and the site sends buyers to a sales form (0). No free tier or trial was found, and the mock service needs a tenant set up by Jumio (0). OAuth2 is activated by an account manager, so no agent can onboard alone (0).", "reliability": "Graded on the Platform REST APIs with the hosted lines. Statuspage at monitor.jumio.com with 48 components by data centre, plus an unauthenticated health endpoint per region (20). In the 90 days to 8 October 2026 there were four degradations of processing, on 14 to 15 August (about 20 hours, mainly the EU), 30 September and twice on 1 October (the second ran 13.5 hours), each causing delays and unexpected MISSING_MANDATORY_DATAPOINTS rejections, and a 35-minute outage of the Singapore data centre on 2 September that Jumio marked critical. No core API was down for an hour, so we scored between the minor and major lines (12). Limits are published per tenant, 10 token requests, 1 new transaction and 15 retrievals a second (15). A 429 with a JSON body is documented, with a retrieval retry schedule from 40 to 940 seconds and general backoff advice. No Retry-After header or idempotency key was found (8). No SLA found in public pages (0). GA (10).", "schema": "Five OpenAPI 3.0 files download from the reference pages, covering 25 operations across Accounts, Credentials, Retrieval, Aggregate and Public Status (25). llms.txt and a 2.2 MB llms-full.txt in Markdown, and robots.txt lists both (10). Operations carry a summary and a link to a guide, and the guides explain order of use. Few say when not to use an endpoint (12). String lengths, patterns, UUID formats and 57 enums in the Retrieval spec, but `overrideSettings` is a free-form object and the mock service packs JSON into `customerInternalReference` (11). Request and response examples throughout, and decision labels in tables. The specs list only 401, 403 and 404, with 400 and 429 described in prose (9). Paths carry /api/v1 and the specs are versioned 1.0.0, 1.0.2 or v0. No changelog for the REST APIs was found, only undated SDK changelogs (6).", "security": "OAuth2 client credentials with 60-minute bearer tokens. Each client is limited to initiate, to retrieve and delete, or both, and can be deactivated. The Retrieval spec names a `transactions/retrieval` scope. No secret expiry or rotation procedure was found beyond generating a new pair (26). An initiate-only client can't read results, but reading and deleting share one permission and no confirmation step exists for DELETE (10). Responses carry text extracted from documents and watchlist results, with no injection guidance found (3). The Portal Audit Log records user actions with email, IP address and result since 1 September 2023. It isn't stated to cover API calls (9). SOC 2, ISO 27001 and PCI DSS 4.0.1 on the Trust Centre and an unpaid vulnerability disclosure programme. No bug bounty, and security.txt returns 404 (15).", "transparency": "Closed service with no public service agreement or API terms. The terms of use page covers end users in the United States (8). The Online Services Privacy Notice, updated 4 August 2026, says Jumio is the controller in general and the processor for certain customers, uses data to improve its services through machine learning, and destroys biometric data within three years. Other retention periods are available on request, and no public DPA was found. The docs say tenant retention is set through support (15). The SDK maintenance policy gives 9 months of support, 24 months to end of life and 3 months' notice of an earlier end. Basic authentication is marked deprecated with no date, and no policy for the REST APIs was found (12). Three data centre regions are named, and the list of third parties is available on request only (6)." }, "sources": [ { "what": "docs index (llms.txt)", "url": "https://documentation.jumio.ai/llms.txt", "seen": "2026-10-08" }, { "what": "full docs in Markdown", "url": "https://documentation.jumio.ai/llms-full.txt", "seen": "2026-10-08" }, { "what": "authorisation and token URLs", "url": "https://documentation.jumio.ai/docs/developer-resources/API/authorization", "seen": "2026-10-08" }, { "what": "integration prerequisites", "url": "https://documentation.jumio.ai/docs/developer-resources/API/integration-prerequisites", "seen": "2026-10-08" }, { "what": "rate limits", "url": "https://documentation.jumio.ai/docs/developer-resources/API/CreateUpdateAccounts/rate-limits", "seen": "2026-10-08" }, { "what": "Account API reference and OpenAPI file", "url": "https://documentation.jumio.ai/redocusaurus/account.yaml", "seen": "2026-10-08" }, { "what": "Retrieval API OpenAPI file", "url": "https://documentation.jumio.ai/redocusaurus/retrieval-v3.yaml", "seen": "2026-10-08" }, { "what": "Credentials API OpenAPI file", "url": "https://documentation.jumio.ai/redocusaurus/credentials.yaml", "seen": "2026-10-08" }, { "what": "Aggregate API OpenAPI file", "url": "https://documentation.jumio.ai/redocusaurus/aggregateAPI.yaml", "seen": "2026-10-08" }, { "what": "retrieval guide and retry policy", "url": "https://documentation.jumio.ai/docs/developer-resources/retrieval", "seen": "2026-10-08" }, { "what": "callback integration", "url": "https://documentation.jumio.ai/docs/developer-resources/callback", "seen": "2026-10-08" }, { "what": "mock service", "url": "https://documentation.jumio.ai/docs/developer-resources/API/test-with-the-mock-service", "seen": "2026-10-08" }, { "what": "health check", "url": "https://documentation.jumio.ai/docs/developer-resources/bestPractices/health-check", "seen": "2026-10-08" }, { "what": "Portal application settings, OAuth2 clients", "url": "https://documentation.jumio.ai/docs/portals/settings/IDVSettings", "seen": "2026-10-08" }, { "what": "Portal audit log", "url": "https://documentation.jumio.ai/docs/portals/settings/auditLog", "seen": "2026-10-08" }, { "what": "credential deletion and retention", "url": "https://documentation.jumio.ai/docs/developer-resources/API/CreateUpdateAccounts/deleting-credentials", "seen": "2026-10-08" }, { "what": "watchlist screening", "url": "https://documentation.jumio.ai/docs/references/capabilities/watchlist", "seen": "2026-10-08" }, { "what": "client libraries, Java", "url": "https://documentation.jumio.ai/docs/developer-resources/client-libraries/java-client-lib/java-client-library", "seen": "2026-10-08" }, { "what": "SDK maintenance policy", "url": "https://documentation.jumio.ai/docs/developer-resources/maintenance/maintenance-overview", "seen": "2026-10-08" }, { "what": "status incidents (JSON)", "url": "https://monitor.jumio.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "status components (JSON)", "url": "https://monitor.jumio.com/api/v2/components.json", "seen": "2026-10-08" }, { "what": "live health endpoint, US", "url": "https://status.amer-1.jumio.ai", "seen": "2026-10-08" }, { "what": "Trust Centre", "url": "https://trust.jumio.com/", "seen": "2026-10-08" }, { "what": "vulnerability disclosure programme", "url": "https://vdp.jumio.com/", "seen": "2026-10-08" }, { "what": "Online Services Privacy Notice", "url": "https://www.jumio.com/privacy-center/privacy-notices/online-services-notice/", "seen": "2026-10-08" }, { "what": "terms of use", "url": "https://www.jumio.com/terms-of-use/", "seen": "2026-10-08" }, { "what": "pricing URL (404)", "url": "https://www.jumio.com/pricing/", "seen": "2026-10-08" }, { "what": "security.txt (404)", "url": "https://www.jumio.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "Android SDK repository and tags", "url": "https://github.com/Jumio/mobile-sdk-android", "seen": "2026-10-08" }, { "what": "iOS SDK repository and tags", "url": "https://github.com/Jumio/mobile-sdk-ios", "seen": "2026-10-08" }, { "what": "npm @jumio/websdk", "url": "https://registry.npmjs.org/@jumio/websdk", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=jumio", "seen": "2026-10-08" }, { "what": "RDAP for jumio.com", "url": "https://rdap.org/domain/jumio.com", "seen": "2026-10-08" } ], "openQuestions": [ "No service agreement, API terms or DPA is published, so `provenance.terms` is left out. Whether customers receive an SLA under contract wasn't established", "No price, trial or free tier was found on public pages. We didn't contact sales", "unchecked: support.jumio.com, which the docs give as the support channel, and whether it needs a login", "unchecked: GitHub issue counts and reply times for the Jumio repositories (the GitHub API refused us for its rate limit)", "unchecked: the documents behind trust.jumio.com, which lists SOC 2, ISO 27001 and PCI DSS 4.0.1 as compliant without dates in the page we read", "Whether a 429 carries Retry-After, and whether GET /api/v1/workflow-executions accepts paging or filters that the spec omits", "Whether callbacks are signed. Only source IP addresses and hostnames per region were found", "Whether the Portal Audit Log records API calls made with OAuth2 clients", "Prepared data accepts business fields and `kybCapabilities`, but no business verification workflow is documented, so kyc.business isn't listed", "The Java client's release date wasn't found. It installs from repo.api.jumio.ai, not Maven Central", "githubStars is Jumio/mobile-sdk-android and npmWeekly is @jumio/websdk (28 September to 4 October 2026), both capture SDKs, since no public server-side package exists" ] }, "negative": 0, "verdict": "Five OpenAPI 3.0 files, an llms.txt index and OAuth2 clients limited to initiating or to retrieving and deleting make the API readable and containable. Access starts with an account manager, with no public price, trial or service agreement, and the status page shows four processing degradations and a 35-minute Singapore outage between 14 August and 2 October 2026.", "bestFor": "An enterprise with a Jumio contract that wants document, selfie and liveness checks, watchlist screening and Latin American, Thai and Australian database checks behind OpenAPI-described endpoints.", "strengths": [ "Five downloadable OpenAPI 3.0 files covering 25 operations, plus llms.txt and a 2.2 MB llms-full.txt of the docs in Markdown", "OAuth2 client credentials with 60-minute bearer tokens. Each client is limited to initiate, to retrieve and delete, or both, and can be deactivated", "Rate limits are published per tenant. Token requests 10 a second, new transactions 1 a second, retrievals 15 a second", "Statuspage at monitor.jumio.com by data centre, and an unauthenticated health endpoint per region that answers UP, DEGRADED or DOWN", "SOC 2, ISO 27001 and PCI DSS 4.0.1 listed on the Trust Centre, and a vulnerability disclosure programme at vdp.jumio.com" ], "weaknesses": [ "No public price, free tier or trial. OAuth2 and workflow keys are activated by a Jumio account manager", "No service agreement or DPA is published. The public terms of use cover end users in the United States", "Four processing degradations and a 35-minute Singapore outage on the status page between 14 August and 2 October 2026", "No idempotency key. A repeated POST or PUT on accounts starts another transaction", "GET /api/v1/workflow-executions takes no paging or filter parameters, and the specs document only 401, 403 and 404 errors", "Retention periods and the sub-processor list are available on request only, and security.txt returns 404" ], "agentNotes": [ "Use the host for the tenant's region (amer-1, emea-1 or apac-1). Tokens come from auth.\u003cregion\u003e.jumio.ai/oauth2/token with the client ID and secret as Basic credentials", "Reuse the bearer token for its 60 minutes. Token requests are limited to 10 a second and new transactions to 1 a second per tenant", "Send a User-Agent header on every call. The Account API marks it required", "Don't blindly retry POST /api/v1/accounts. Each call creates an account and a transaction, and no idempotency key exists", "Wait for the callback or poll the status endpoint until PROCESSED before retrieving. Jumio's retry schedule starts at 40 seconds and stops after 940" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55 } ], "editorialScores": { "ergonomics": 45, "maintenance": 75, "payments": 0, "reliability": 65, "schema": 73, "security": 63, "transparency": 41 }, "provenanceScore": 78 }, "connect": { "http": "curl --location 'https://auth.amer-1.jumio.ai/oauth2/token' \\\n -u CLIENT_ID:CLIENT_SECRET \\\n --header 'Accept: application/json' \\\n --data-urlencode 'grant_type=client_credentials'" }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/jumio" }, "notable": [ "Five OpenAPI 3.0 files are downloadable from the reference pages. Accounts (2 operations), Credentials (8), Retrieval (12), Aggregate (2) and Public Status (1) (https://documentation.jumio.ai/developer-resources/api/retrieval)", "Rate limits apply per tenant. Token requests 10 a second, new transactions 1 a second and retrievals 15 a second, with a 429 and a JSON body when exceeded (https://documentation.jumio.ai/docs/developer-resources/API/CreateUpdateAccounts/rate-limits)", "OAuth2 clients are created in the Portal with permission to initiate, to retrieve and delete, or both (https://documentation.jumio.ai/docs/portals/settings/IDVSettings)", "A Jumio account manager activates OAuth2 and supplies workflow keys before integration starts (https://documentation.jumio.ai/docs/developer-resources/API/integration-prerequisites)", "monitor.jumio.com lists four processing degradations and a 35-minute outage of the Singapore data centre between 14 August and 2 October 2026 (https://monitor.jumio.com/history)", "Each region has an unauthenticated health endpoint, such as https://status.amer-1.jumio.ai, that answers UP, DEGRADED or DOWN by component (https://documentation.jumio.ai/docs/developer-resources/bestPractices/health-check)", "The only Jumio entry in the official MCP registry is a third-party stdio server, io.github.codespar/mcp-jumio. No official MCP server was found (https://registry.modelcontextprotocol.io/v0.1/servers?search=jumio)", "Mobile SDK versions reach end of support 9 months after release and end of life after 24 months, with at least 3 months' notice of an earlier end (https://documentation.jumio.ai/docs/developer-resources/maintenance/maintenance-overview)" ], "area": "domain-data", "details": [ { "label": "Surface graded", "value": "Jumio Platform REST APIs (v1 paths) in three regions, US (amer-1), EU (emea-1) and Singapore (apac-1). No official MCP server found" }, { "label": "Endpoints", "value": "POST and PUT /api/v1/accounts on account.\u003cregion\u003e.jumio.ai, credential part uploads and workflow finalisation on api.\u003cregion\u003e, retrieval, status, steps, rules, feedback and deletion on retrieval.\u003cregion\u003e, and the Aggregate API on kyx.\u003cregion\u003e" }, { "label": "Credentials", "value": "OAuth2 client credentials. Client ID and secret pairs from the Portal with initiate, retrieve and delete, or both. Bearer tokens last 60 minutes" }, { "label": "Rate limits", "value": "Per tenant. Token requests 10 a second, new transactions 1 a second with some burst allowance, retrievals 15 a second. Higher limits through Jumio Support" }, { "label": "Testing", "value": "A mock service returns chosen decisions for synthetic transactions. It needs a dedicated tenant configured by Jumio Support or the account manager" }, { "label": "Callbacks", "value": "JSON POST to a global or per-request callback URL with the workflow status and retrieval links. Jumio publishes source IP addresses per region for allowlisting. No signature scheme was found" }, { "label": "Retry guidance", "value": "Retrieval retries at 40, 60, 100, 160, 240, 340, 460, 600, 760 and 940 seconds after the callback, then stop and check the status page" }, { "label": "Deletion", "value": "DELETE endpoints remove all credentials or only biometrics for an account or a transaction. Metadata and the decision are kept. A tenant-wide retention period is set through Jumio Support" }, { "label": "Checks", "value": "ID and selfie verification with liveness, Doc Proof, watchlist screening for sanctions and PEPs, and database checks for Argentina, Australia, Brazil, Colombia, Mexico, Peru and Thailand, plus US SSN and DMV checks" }, { "label": "SDKs", "value": "Server libraries for Java Spring Boot (com.jumio:jumio-client 1.1.0 from repo.api.jumio.ai) and .NET (a download). Capture SDKs for Android 4.19.1 and iOS 4.19.0, React Native, Flutter, Cordova and @jumio/websdk 0.6.2" }, { "label": "Audit", "value": "The Portal Audit Log records user actions with email, IP address, time and result, back to 1 September 2023" }, { "label": "Certifications", "value": "SOC 2, ISO 27001 and PCI DSS 4.0.1 listed as compliant on trust.jumio.com" }, { "label": "Status", "value": "monitor.jumio.com on Statuspage, 48 components grouped by US, EU and Singapore data centres and third-party services" } ], "provenance": { "legalEntity": "Jumio Corporation", "domain": "jumio.com", "domainRegistered": "2004-03-30", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://www.jumio.com/privacy-center/privacy-notices/online-services-notice/", "statusPage": "https://monitor.jumio.com", "changelog": "https://documentation.jumio.ai/docs/developer-resources/SDKs/mobile-sdk/mobile-sdk-android-master/docs/changelog", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Online Services Privacy Notice (last updated 4 August 2026) names Jumio Corporation, 100 Mathilda Place, Suite 100, Sunnyvale, CA 94086, with Jumio Software Development GmbH in Linz as EU representative.", "No terms field. Jumio publishes no service agreement or API terms for customers. www.jumio.com/terms-of-use/ (last updated 18 June 2026) is addressed to end users in the United States, so it isn't recorded as the governing document.", "The APIs answer on jumio.ai hosts (auth, account, api, retrieval, kyx and status under amer-1, emea-1 and apac-1), a second domain used throughout Jumio's own documentation at documentation.jumio.ai.", "www.jumio.com/.well-known/security.txt and /security.txt return 404. Reports go to the vulnerability disclosure programme at https://vdp.jumio.com, which pays nothing.", "The changelog linked is the Android SDK's. No changelog for the REST APIs was found.", "RDAP for jumio.com gives a registration date of 2004-03-30." ], "score": 78, "checks": [ { "check": "Legal entity named", "value": "Jumio Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "jumio.com, registered 2004-03-30 (22 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "jumio.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "monitor.jumio.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://www.jumio.com/privacy-center/privacy-notices/online-services-notice/", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-08-04", "words": 3233, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: August 4, 2026", "says": "Last updated 2026-08-04" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "As part of this Service, we collect, analyze, and retain personal information collected in connection with transactions on an ad–hoc and an ongoing basis provided by or on behalf of our Customers and their End Users, including information contained in government-issued identification documents and facial images." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Except as otherwise provided in this Notice, we retain personal information for as long as necessary to: (i) fulfill the purposes outlined in Section 6, (ii) comply with legal obligations, or (iii) defend against potential legal claims.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "For certain Customers (including some in the EEA/UK), Jumio serves as a “processor” (or “service provider”)." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Please note: we do not sell, share, or otherwise use your personal information for cross-contextual behavioral advertising.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Please begin with the Customer with which you have an existing relationship for information about your privacy rights." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Jumio’s Data Protection Officer and Person in Charge (“Encarregado”), Joe Kaufmann, may be contacted at [email protected].", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "We may rely on adequacy decisions for certain countries, or include standard contractual clauses in our contracts with recipients which are accessible upon request via the contact details provided in Section 16.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "To perform analytics and research concerning the Services and to improve the Services or develop new services, including through the use of machine learning;", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "As a controller, Jumio keeps biometric data derived from images and recordings for up to three years unless the law requires a shorter period.", "quote": "Jumio will permanently destroy such biometric data derived from images and recordings in its possession within three years, except where a shorter period is required by law after you first provided those images or videos." }, { "date": "2026-10-08", "text": "After consent is withdrawn, Jumio may keep personal information as the law permits, including to identify potentially fraudulent transactions.", "quote": "Jumio may retain your personal information independent of your consent as permitted by applicable law and to the extent necessary to establish, exercise or defend legal claims, to comply with legal obligations, or to identify potentially fraudulent transactions." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/jumio.json", "live": { "slug": "jumio", "vendorStatus": { "page": "https://monitor.jumio.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:50:46.59004657Z" }, "pages": [ { "url": "https://documentation.jumio.ai/docs/developer-resources/SDKs/mobile-sdk/mobile-sdk-android-master/docs/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:19:56.339175642Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "4e0b13492ecb" }, { "url": "https://www.jumio.com/privacy-center/privacy-notices/online-services-notice/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:28:35.8188334Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47ddc34e8761" } ], "updatedAt": "2026-10-08T19:50:46.59004657Z" } } }