Jiayang Cloud

For IT

See every app your company built

Updated

People are building apps with AI agents and putting them online. On Jiayang Cloud each one stays behind sign-in, and owners and admins get one list of every app, who can open it, where it sends data and who opened it, on every plan.

Apps built this way don't always stay private. In May 2026, researchers at RedAccess said they had found about 380,000 publicly reachable apps and other assets made with AI app builders, and that about 5,000 of them held sensitive corporate information (source). Here every app starts private, and only the people you share it with can open it. A public path, for webhooks, has to be added by a person.

Every app in one list

In the dashboard, a workspace's owners and admins get a row for every app, whether or not it's shared with them:

Download it as CSV on any plan, or read it from the CLI with jiayang app list acme, which adds the same details under each app. See See every app.

Every request, and who changed what

The audit log has every request the edge let in or refused, and every change, with who made it: a person, an agent, a bypass token, a GitHub run or a scheduled job. Read it on the Activity page, with jiayang audit acme, or live with jiayang watch acme.

It's kept for 3 months on Free and Team, and 12 months on Business and Enterprise.

Who uses what

Usage insights count the log into people and visits: how many people opened each app, how often and when last. They list the apps nobody opened in 30, 60 or 90 days, and the apps whose owners have all left. They look back 30 days on Free, 90 on Team and 365 on Business and Enterprise.

Rules for who may open apps wider

Every app starts private. A publish policy says who may open an app to the whole workspace, share it outside the company, open public paths, make tokens and agent credentials, and connect AI clients. What was shared before a rule is listed for you to end. A publish policy is an Enterprise feature. It's included on Business for early customers, for a limited time.

Allowed email domains keep sharing to addresses at your company, and shut out anyone an app was shared with before at another domain.

No secrets in app code

An app calls a third-party API without its key. You store the key with us, and our outbound proxy adds it to the app's requests to that host, so it stays out of the code, the logs and the versions. Each app can be held to a list of hosts it may send requests to. Company keys for Anthropic, OpenAI and other AI providers can be given to apps with a monthly budget each, without the key reaching their code. All of this is on every plan. See Secrets, Sending requests out and Company AI keys.

Every deploy scanned

Each deploy is checked before it goes live for keys left in the code and for packages with published vulnerabilities in OSV, whoever or whatever deployed it. The workspace chooses whether a deploy with findings goes live with a warning or is refused, and some kinds of key, such as private keys, are always refused. See Deploy scans.

Your identity provider and your SIEM

Single sign-on sends your people through Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 or OpenID Connect provider, and can be required. SCIM adds and removes them. Audit streaming sends the log to Splunk, Datadog, an HTTPS collector of yours or an S3 bucket. These are Enterprise features, included on Business for early customers, for a limited time.

Agents with names of their own

A bot or a nightly job can be an agent of the workspace: it reaches only the apps you grant it, with credentials you can revoke, and every request it makes shows in the log under its name. A coding agent a person uses, such as Claude Code, acts as that person and shows under their name.

Questions

Can someone make an app public?

Not the whole app. A public path opens only the paths an app names, for webhooks, and only a person in the dashboard can add one. A publish policy can limit who may.

Where is our data kept?

In the United States. Our own database, which holds accounts, sharing, settings and the last 30 days of the audit log, is in AWS us-east-2 (Ohio). Requests are served by Cloudflare's data centre nearest the person making them. Keeping an Enterprise workspace's app data in the EU isn't open yet. See Keeping data in the EU.

Can we take everything out?

Yes, on every plan. An owner can export the workspace as one JSON file: its settings, members, groups, every app and who it's shared with, the names of its secrets and tokens, never their values, and the audit log your plan keeps. Each app's database exports as SQL.

Do we hear about changes as they happen?

Webhooks and Slack can get each deploy, share, new member and new token. Each Monday, owners get an email with the week's deploys, shares, refused visits and usage.

Source

  1. Thousands of Vibe-Coded Apps Exposing Corporate, Personal Data: RedAccess, Security Boulevard, 7 May 2026. The figures come from RedAccess's chief executive, in interviews with Axios and WIRED. Checked 16 October 2026.

Next