# Jamf

> Sets up Macs, iPhones and iPads centrally, distributes apps and settings, enforces security baselines and documents which device is in which state. A lost device, or one belonging to someone who leaves, can be locked or wiped remotely.

- Vendor: JAMF Software, LLC, Minneapolis, Minnesota
- Canonical URL: https://www.convios.com/en/toolbox/jamf
- Language version: https://www.convios.com/de/werkzeugkasten/jamf
- Area: Governance & security · Cluster: device management
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-09-28 · Reviewed: 2026-09-28 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: Device management decides whether a security questionnaire, a NIS2 review or a due diligence stalls on the question of who holds which device in which state. Company-wide AI use adds a second task: the AI tools running on the machines can only be governed where the devices are managed. Jamf ships its own function for this in the Mac bundle. Both keep you level with the market, and every competitor can buy the same.

## Suitability by company size

- Solo: suitable with caveats — For fewer than 25 employees there is Jamf Now from 4 US dollars per device per month. According to the vendor, Jamf Now is hosted in the United States only, with no choice of location at this tier.
- Mid-market: suitable — Jamf for Mac costs 12.50 US dollars per Mac per month, billed annually, with a 25-device minimum, so about 3,750 US dollars a year as the floor. Management, endpoint protection and access control are included. The management component itself can run in Frankfurt, while parts of the bundle run in Ireland and the United States.
- Enterprise: suitable — The contract, data processing agreement, subprocessor list and an ISO 27001 certificate valid until 2029 are all public. Streaming logs into your own analytics systems only comes with Premium Cloud, whose price is not published, and Windows devices need a second system.

## Vendor staying power

Established: In the market since 2000, listed until January 2026 and owned by a financial investor since. According to the last published annual figures, 2024 closed with an operating loss of 69.1 million US dollars under US GAAP and, adjusted for special items, an operating profit of 103.1 million US dollars. According to the regulatory filing, the acquisition was funded from the buyer's equity, a new secured term loan at the acquiring entity and Jamf's existing cash. Since the delisting, no quarterly figures are published any more.

- Ownership: Acquisition by Francisco Partners closed on 30.01.2026 at 13.05 US dollars per share, enterprise value about 2.2 billion US dollars, delisted from Nasdaq (source: https://www.sec.gov/Archives/edgar/data/1721947/000110465926009193/tm264539d2_ex99-1.htm, as of 2026-09-28)
- Last published annual figures: Fiscal 2024: revenue 627.4 million US dollars (up 12 percent), annual recurring revenue 646.0 million US dollars, operating loss under US GAAP 69.1 million US dollars, adjusted operating profit 103.1 million US dollars (source: https://www.sec.gov/Archives/edgar/data/1721947/000162828025008638/jamf-12312024x8kxex991.htm, as of 2026-09-28)
- Customer count per vendor: more than 76,600 organisations, a figure given in the vendor's own trust centre (source: https://www.jamf.com/trust-center/, as of 2026-09-28)
- Certification: ISO/IEC 27001:2022 by A-LIGN, renewed on 18.08.2026, valid until 04.05.2029, extended by ISO/IEC 27017, 27018 and 27701 (source: https://media.jamf.com/images/Certifications/21-Jamf_Software-2026-ISO_27001_2022-Recertification-Certificate_ANAB.pdf, as of 2026-09-28)
- Documented vulnerability: CVE-2026-1290, authentication bypass in Jamf Pro 11.20 to 11.24, published on 21.01.2026, medium severity (CVSS 4.0: 5.3) (source: https://nvd.nist.gov/vuln/detail/CVE-2026-1290, as of 2026-09-28)

## Cost of leaving

Moderate: Apple has taken the sting out of moving devices since iOS 26 and macOS 26: through Apple Business, devices enrolled automatically can be assigned to a new management service with a deadline, without being wiped, and on iPhone and iPad optionally with their apps and data. Older devices and those not registered through Apple Business still have to be moved by hand. What is missing after the move is everything that grew inside Jamf: policies, scripts, dynamic device groups, custom inventory fields and the links to identity and endpoint protection. All of that has to be rebuilt and tested in the new system.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | publicly available, June 2025 version, takes effect when the agreement is accepted — The legal page of the trust centre publishes the agreement freely, and it applies from signature or from clicking to accept the agreement in the product. For questions about concluding it, the privacy page of the same portal gives the address privacy@jamf.com. | evidenced | 2026-09-28 |
| Storage location | Jamf Pro selectable in Frankfurt or London, defaulting to the location nearest the business address; Jamf Now United States only; security cloud functions in Ireland — The EU location depends on the product. The smallest tier, Jamf Now, runs in the United States only. On top of that come subprocessors that work in the United States only across all products, including data pipeline orchestration and product analytics. | partially evidenced | 2026-09-28 |
| Subprocessors | public list with product, processing location and purpose for each subprocessor, last changed on 02.06.2026 — The list separates product services, support services and the vendor's own subsidiaries. Changes are announced, and the customer can object within 30 business days. | evidenced | 2026-09-28 |
| Third-country transfer | transfers to the USA and other third countries, based on standard contractual clauses, the UK addendum and Swiss clauses; participation in the EU-US Data Privacy Framework — The clauses are completed within the data processing agreement, with Irish law as governing law. The vendor also publishes its own transfer impact assessment as a template for the customer's review. | evidenced | 2026-09-28 |
| Training on customer data | contractually excluded for inputs and outputs of the AI functions; AI functions are switched off by default — The AI addendum rules out using inputs or outputs to train, develop or refine any model it uses. Pre-release versions of AI functions are expressly outside this addendum and fall under the separate terms for beta offerings. The model providers are bound as subprocessors to the same obligations under the data processing agreement. | evidenced | 2026-09-28 |
| Retention and deletion | return or deletion on request after contract end, retention of 90 days after processing ends; log retention periods are set by the administrator — The 90-day period is stated in the annex to the data processing agreement. According to the security measures, the vendor may keep backup copies until the agreement ends. | evidenced | 2026-09-28 |
| Certifications | ISO/IEC 27001:2022 with 27017, 27018 and 27701 in scope, valid until 04.05.2029; SOC 2 on request; listing in the Cloud Security Alliance registry; Cyber Essentials — The certificate lists the in-scope products individually, including Jamf Pro, Jamf Now, Jamf Protect and Jamf Connect. The SOC 2 report is available on request through the trust centre. | evidenced | 2026-09-28 |
| EU AI Act, Article 50 | statement on the regulation only for the vendor's own processing as controller; no commitment on Article 50 for the AI assistant in the product — The privacy policy, last updated on 23.07.2026, invokes the AI Act, and does so for AI in the vendor's own business operations such as sales, recruiting, analytics and security monitoring. For the product, the AI addendum binds both parties in general terms to applicable AI law and forbids the customer from presenting outputs as human-made. The assistant works with administrators. | partially evidenced | 2026-09-28 |
| Audit logging | change and access logs in Jamf Pro; retention is set by the administrator; streaming to Splunk, Amazon S3, Datadog or your own endpoint only with Premium Cloud — The change log records create, read, update and delete with user and timestamp. Transfer runs every two or fifteen minutes depending on the target. The price of Premium Cloud is not published. | partially evidenced | 2026-09-28 |

## Cost

- Entry: Jamf for Mac costs 12.50 US dollars per Mac per month, Jamf for Mobile 5.75 US dollars per mobile device per month, both billed annually with a 25-device minimum. Jamf Now for fewer than 25 employees starts at 4 US dollars per device per month. (as of 2026-09-28)
- Where it gets expensive: Costs rise in three places. The bundles combine management, endpoint protection and access control, so anyone already paying for tools covering the last two pays twice. Log streaming and fixed IP allowlists only come with Premium Cloud, whose price is not published. And anyone managing Windows alongside Apple needs a second system with a second set of policies to maintain. List prices are in US dollars; quotes in euros go through sales or resellers.

## Three routes compared

### Microsoft Intune from the existing Microsoft 365 contract

Where Intune is included in the existing Microsoft 365 licences, it manages Windows, Apple and Android from one console, coupled to conditional access through Entra. For companies with a mixed fleet, that argues for the existing contract. Jamf is built around Apple and bundles endpoint protection and access control. Whether that justifies a second contract comes down to matching the Apple functions you actually need against what the existing contract already includes.

### Iru, called Kandji until October 2025

Kandji renamed itself Iru on 22.10.2025 and has since presented itself as an AI-driven platform that merges identity, device management for Apple, Windows and Android, endpoint protection and compliance automation. Prices there are on request per module, so a public price comparison is not possible. Iru combines identity, device management, endpoint protection and compliance automation with one vendor, while Jamf's Mac bundle combines three of them.

### Apple Business with an open-source management server

Apple itself supplies the foundation: Apple Business enrols the devices automatically, the management protocol is documented, and there are open-source management servers that speak it. A team can adapt such a server with Claude Code, handle administrator sign-in through Ory, secure access to the console through Tailscale, and keep push certificates and keys in Infisical. It gets hard in two places. Apple changes the management interfaces with every operating system generation, and the push certificate expires every year, and both need someone on call. And for an audit there is no certificate, no log streaming and no party that answers for the operation.

Recommendation by size:

- Solo: With a handful of Macs, first check whether Apple Business with its built-in tools is enough. Take Jamf Now only with the US location in mind.
- Mid-market: Buy if the fleet is mostly Apple. First settle which endpoint protection and access tools the bundle replaces.
- Enterprise: Alongside Intune only if the Apple requirements justify it. Settle Premium Cloud and the price of log streaming in writing before signing.

## Context

- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — The test asks how dense the evidence duties are, and that decides whether streaming device logs stays an add-on or forces the jump to Premium Cloud.
- Implements method: ["Context: Moat or Wall?" Test](https://www.convios.com/en/methods/context-moat-or-wall-test) — Managed devices are the foundation on which company-wide AI use can be governed at all, and the test classifies that foundation as keeping pace, something every competitor can buy as well.
- Implements method: [Operating Model Grid (Standardization and Integration)](https://www.convios.com/en/methods/operating-model-raster) — After acquisitions several device fleets with their own tools often sit side by side, and the grid clarifies before consolidating what benefit central Apple management brings the business and what the migration costs.
- Alternative: [Tailscale](https://www.convios.com/en/toolbox/tailscale)
- Alternative: [Ory](https://www.convios.com/en/toolbox/ory)
- Displaces: Manual setup of new devices by IT, Spreadsheets of serial numbers, owners and software versions, Antivirus and VPN programs installed one by one, Wiping a device by calling the employee

## Evidence

- Plans and per-device prices, 25-device minimum, Jamf Now for fewer than 25 employees, Premium Cloud — https://www.jamf.com/pricing/ (as of 2026-09-28)
- Data processing agreement, June 2025 version: standard contractual clauses, 72-hour breach notice, objection within 30 business days, 90-day retention after contract end — https://media.jamf.com/documents/compliance/data-processing-agreement-for-jamf-customers-june-2025.pdf (as of 2026-09-28)
- AI addendum: no training on inputs and outputs, pre-release versions excluded — https://media.jamf.com/documents/compliance/jamf-ai-addendum-for-customers.pdf (as of 2026-09-28)
- Subprocessors with product, location and purpose, as of 2 June 2026; AI functions switched off by default — https://www.jamf.com/trust-center/legal/jamf-sub-processors/ (as of 2026-09-28)
- Processing locations per product, Jamf Now United States only, as of 2 March 2026 — https://www.jamf.com/trust-center/jamf-cloud-hosting-locations/ (as of 2026-09-28)
- Legal documents in the trust centre, data processing agreement linked publicly — https://www.jamf.com/trust-center/legal/ (as of 2026-09-28)
- Privacy page gives privacy@jamf.com for questions about concluding the data processing agreement — https://www.jamf.com/trust-center/privacy/ (as of 2026-09-28)
- Privacy policy, last updated 23 July 2026, referring to the AI Act for the vendor's own processing as controller — https://www.jamf.com/trust-center/privacy/privacy-policy/ (as of 2026-09-28)
- Change and access logs, streaming only with Premium Cloud, transfer intervals — https://developer.jamf.com/jamf-pro/docs/jamf-log-stream (as of 2026-09-28)
- ISO/IEC 27001:2022, renewed 18 August 2026, valid until 4 May 2029, scope listing the products — https://media.jamf.com/images/Certifications/21-Jamf_Software-2026-ISO_27001_2022-Recertification-Certificate_ANAB.pdf (as of 2026-09-28)
- Acquisition by Francisco Partners closed on 30 January 2026 — https://www.sec.gov/Archives/edgar/data/1721947/000110465926009193/tm264539d2_ex99-1.htm (as of 2026-09-28)
- Fiscal 2024 figures: revenue, recurring revenue, operating loss — https://www.sec.gov/Archives/edgar/data/1721947/000162828025008638/jamf-12312024x8kxex991.htm (as of 2026-09-28)
- CVE-2026-1290, Jamf Pro 11.20 to 11.24, medium severity — https://nvd.nist.gov/vuln/detail/CVE-2026-1290 (as of 2026-09-28)
- Moving devices between management services without wiping from iOS 26 and macOS 26 — https://support.apple.com/guide/deployment/migrate-managed-devices-dep4acb2aa44/web (as of 2026-09-28)
- Kandji renamed Iru on 22 October 2025 — https://www.iru.com/newsroom/kandji-now-iru (as of 2026-09-28)
- Acquisition funded from equity, a new secured term loan and existing cash — https://www.sec.gov/Archives/edgar/data/1721947/000110465926009193/tm264539d2_8k.htm (as of 2026-09-28)
- Participation in the EU-US Data Privacy Framework — https://media.jamf.com/documents/compliance/jamf-customer-dpa-faq-june-2025.pdf (as of 2026-09-28)
- Jamf Pro data regions Frankfurt and London — https://learn.jamf.com/r/en-US/technical-articles/Jamf_Cloud_Hosted_Data_Region_Information (as of 2026-09-28)
- Intune is included in Microsoft 365 bundles such as E3 and E5 — https://learn.microsoft.com/en-us/intune/fundamentals/licensing (as of 2026-09-28)
- Jamf founded in 2000 — https://www.jamf.com/about/ (as of 2026-09-28)
- Log retention via the log flushing setting — https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/Log_Flushing.html (as of 2026-09-28)