Jadu Application Security Review
Jadu Central forms trigger automation rules on submission, and case data moves out through webhooks and APIs. We test what those rules and integrations can do once a case leaves the form. CREST-certified testers, fixed price from £3,380 for a 3-day single-application scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Jadu Connect pushes and pulls case data through webhooks, its own APIs and a Microsoft Teams integration, and Jadu Central forms trigger automation rules the moment a citizen submits one.
Automation rules and integrations decide where citizen data goes
Jadu Central builds forms and automation rules without writing code, and a rule can act on submitted data before anyone reviews it. We test what an automation rule actually does with the data behind a form, and whether it repeats the same checks the visible form ran on the way in.
Jadu Connect is delivered as a cloud platform with deep integration, webhooks and its own APIs, built to connect case data to back-office systems without a full platform migration. We test how case data moves through those webhooks and APIs, and what happens if a request is replayed or arrives from somewhere it should not.
Case handling can now happen directly inside Microsoft Teams through Jadu’s integration, so a case and the personal data attached to it exists in two connected systems instead of one. We test who can view or close a case from either side of that integration, and whether Teams access matches what the case management permissions intended.
SCOPE
What we pen test on a Jadu application
Form and automation rule validation
We test whether an automation rule that fires when a Jadu Central form is submitted re-validates the data, or trusts whatever the form’s client-side checks allowed through.
Case data webhook integrity
We test whether webhooks carrying case data to your back-office systems verify their origin and cannot be replayed or forged.
API credential scope
We test what a Jadu API credential can read or change, and whether it is scoped to a single integration rather than the whole Connect platform.
Microsoft Teams integration access
We test who can view or close a case through the Microsoft Teams integration, and whether that access matches the permissions the same user has in Jadu Connect.
Form file upload handling
We test how documents uploaded through a citizen-facing form, such as supporting evidence on an application, are validated and stored.
Cross-service case data exposure
Where Connect pulls case data from more than one back-office system, we test whether a user with lower privilege can see fields that belong to a different service.
Subsite and service isolation
For councils running several subsites or services from one Jadu Central instance, we test whether an editor on one can reach content or settings that belong to another.
Session handling across account types
We test session handling across the platform, since a single Jadu deployment can mix public self-service logins with internal case-handling accounts.
Bulk export controls
We test who can export case or citizen data in bulk, and whether export functions carry the same access restrictions as viewing a single case.
Custom automation and module review
Where a council has commissioned custom automation logic or a bespoke module, we test it with the same depth as hand-written code.
OUR PROCESS
Jadu Application Security Review: From Scope to Attestation
Application and integration intake
You give us access to a test instance of the Jadu application plus a list of the integrations, webhooks and APIs in scope.
Case and data flow mapping
We map how forms, automation rules and case data move between Jadu and any connected back-office or Teams integration.
Active testing
We attempt to reach case data, settings or integrations outside each account’s and integration’s intended access.
Report and free retest
You get findings mapped to the specific form, rule or integration involved, then a free retest once fixes are in.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Jadu pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Jadu Application Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Jadu For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Jadu Application Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Jadu application?
A standard user account for the service under test, plus details of any webhooks, APIs or Teams integration in scope. We do not need a platform administrator login unless the review specifically covers administration.
Will testing touch live citizen or case data?
We test against a staging or test instance wherever one exists, and confirm with you before any check that could touch live citizen or case data in production.
How long does a Jadu application review take?
The 3-day single-application scope above covers one Jadu application, such as a single case management service or website. Multiple services or heavy integration in scope can need more time, confirmed during scoping.
Is Jadu hosted by the vendor or by us?
Jadu Connect is delivered as a cloud platform, and Jadu Central deployments vary by contract. We confirm the hosting model during scoping and scope the review accordingly.
What is out of scope?
Jadu’s own hosting infrastructure and shared platform are out of scope unless your contract makes you responsible for the hosting environment. We focus on your configuration, forms, automation rules and integrations.
Does Jadu have a customer penetration testing policy?
Vendor and hosting terms vary by contract, so we confirm the current testing policy for your instance during scoping and work within it.
Do you need details of our automation rules and integrations?
Not required to start, but a list of the automation rules, webhooks and back-office integrations in scope speeds up the review and helps us test the right data flows.
Are your testers CREST certified?
Yes. Every Jadu application review is carried out by CREST-certified, UK-based testers.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Jadu application
Jadu Central forms trigger automation rules on submission, and case data moves out through webhooks and APIs. We test what those rules and integrations can do once a case leaves the form. CREST-certified testers, fixed price from £3,380 for a 3-day single-application scope, quoted within 24 hours.
