Download

Why IT approves Jig

Your people want to build their own tools with AI. Jig lets them, on their own computers, with the AI you already approved, and every app lands in your company’s git where IT can see it, review it and decide what goes to production.

Talk to usDownload Jig
/Library/Application Support/Jig/policy.json
{
  "organization": "Acme Corp",
  "allowedEngines": ["claude-code", "codex"],
  "allowedImageProviders": ["azure-openai-images"],
  "allowedGitHosts": ["github.acme.com"],
  "privateReposOnly": true,
  "allowedPublishTargets": ["zip", "docker"],
  "auditLog": true
}
One file, deployed by MDM. Jig shows “Managed by Acme Corp” and enforces it in its local service.

Every app lands in your git. IT picks what ships.

No more finding out about shadow tools a year later. The apps people build with Jig live where engineering already works, so you can see them, review them and promote the good ones.

  1. Someone builds a toolOn their own computer, with the AI your company approved and the policy you deployed.
  2. It pushes to your gitGitHub, GitLab, Bitbucket or Azure DevOps, cloud or self-hosted, with each person’s own access. Policy can make your hosts the only place code goes, in private repositories.
  3. IT sees and reviews itEvery change is a checkpoint commit with full history, and the audit log records each push and publish.
  4. You choose what goes to productionPromote it through your own pipelines with the Dockerfile, or limit publishing to the targets you allow.

What IT worries about, and what Jig does about it

Ten objections we hear from security and IT teams, answered with what ships today. Anything not built yet is marked “Coming”, and the roadmap lists it in one place.

Shadow IT and hosted AI builders

Hosted builders keep your code and data on their servers and bill per seat or per credit. Teams sign up on a card, and IT hears about it later.

Everything runs on the employee’s computer. Each project is a plain folder and git repository under ~/Jig. Jig’s servers learn who signed in and which version they run, and nothing else about the work.

  • No hosted workspace to audit or offboard
  • Nothing to export: the folder is the project
  • AI usage is billed by your AI vendor, never resold by Jig

“Which AI is this sending our code to?”

Every new tool brings its own model, its own terms and its own data processing agreement.

The AI your company already approved. Jig drives the coding assistant your people already use, Claude Code or OpenAI Codex, plus opencode for other models. Or it connects through your enterprise account: Claude through Amazon Bedrock, Google Vertex AI or Microsoft Foundry, or an Anthropic or OpenAI enterprise API key. IT chooses which assistants and providers are allowed.

  • Usage is billed by that provider to you, under your agreement with them. Jig never charges for AI
  • Cloud sign-in uses your cloud’s own tools: aws sso login, gcloud or az login. Jig never stores cloud credentials
  • If IT already sets the cloud AI environment variables, Jig leaves them alone

Keys and secrets

People paste API keys into chat windows, and keys end up in repositories.

Keys are stored in the operating system’s keychain, and the AI only ever sees their names. When it needs one, it asks through a secure box in the chat.

  • Keys pasted into the chat are caught and saved locally, and a prompt that still contains one is refused
  • .env files are never shown to the AI and never committed
  • Keys and tokens are redacted from everything Jig displays

Control without tickets

Locking a tool down usually means a request queue, or a ban people work around.

One machine-wide policy file sets the rules: allowed engines, connections, image providers, git hosts, publish targets and private-only repositories. Deploy it with your MDM, such as Intune or Jamf, or with Group Policy.

  • Enforced in Jig’s local service, not just hidden in the interface
  • Settings shows “Managed by” your organization
  • An audit log at ~/.jig/audit.jsonl: builds, images, pushes, publishes and connection changes, with time, user and host. Never secret values or prompt text

Corporate networks

Developer tools tend to break behind proxies and TLS inspection.

Jig trusts the certificates IT installed in the OS store, so it works behind TLS-inspecting proxies, and every outbound request honors your proxy settings.

  • HTTPS_PROXY, HTTP_PROXY and NO_PROXY, also read by git and the AI coding assistants
  • Jig itself listens only on 127.0.0.1
  • jig doctor reports the proxy it sees

Your git, your review

Code built outside engineering ends up somewhere nobody can review it.

Projects push to the git server you already run, with the access each person already has. Every change is a checkpoint commit, so there is full history, a plan to approve before bigger changes, and undo.

  • GitHub and GitHub Enterprise Server, GitLab (cloud and self-managed), Bitbucket (Cloud and Data Center), Azure DevOps (Services and Server), Gitea and Forgejo
  • AWS CodeCommit, SSH-only servers and SSO setups through the machine’s own git sign-in
  • Jig never needs admin rights on your git server, and tokens are never written into the repository config
  • Private-only repositories and allowed git hosts set by policy

Updates you control

Tools that update themselves overnight break things on Monday.

Installers for macOS, Windows and Linux, and updates you set per organization: a stable or beta channel, pinning to a version, a minimum required version, and staged rollouts. The app asks people before it updates.

  • Mac builds are signed. Apple notarization and Windows code signing are coming soon.
  • Update now, Later or Skip this version; required updates can’t be skipped
  • Updates install when the app restarts or quits

Ship where you already host

A finished app is only useful once it runs somewhere IT trusts.

Publish to your own Netlify account, take a Dockerfile to your own servers and pipelines, or download a zip of the built site for any static host. Policy decides which of these people may use.

  • Coming: Vercel, Cloudflare Pages, GitHub Pages and Azure Static Web Apps

Accounts and access

Another login to provision, and another to remember to remove.

People sign in with Microsoft, Google, GitHub or email. They join your organization automatically by their work email domain, so plan and update rules follow the account.

  • Coming: single sign-on with SAML or OIDC, including Okta and Entra ID
  • Sign-in tokens live in the OS keychain
  • Projects stay on the company’s computer, not in a personal cloud account

Backups

Work that lives on one laptop is one spilled coffee from gone.

On Pro and Enterprise, Jig backs every project up to your company’s own Google Drive, OneDrive or Dropbox. Backups go straight from the computer to your storage; Jig’s servers never receive them.

  • Secrets files such as .env are never included

One company, not fifty one-off tools

Today, everyone who builds with AI builds alone: duplicated work, a different look every time, and security nobody reviewed. Jig puts every app where your team, and your standards, can reach it.

  1. Start from what the company approvedStarter templates and vetted skills go into every project today. Company templates with your design system, sign-in and data connections are coming.
  2. Build in your git, not on one laptopProjects push to GitHub, GitLab, Bitbucket or Azure DevOps, self-hosted too. Teammates open the same app and carry on.
  3. Review before it changesBigger changes arrive as a plan someone approves. Every change is a checkpoint with history and undo.
  4. Share what worksComing: a shared library of company skills, components and brand kits, so the next app starts where the last one finished.

Roadmap for IT

What you can deploy today, and what we are building next. Nothing under “Coming next” ships until this page says so.

Available now

  • Managed policy fileAllowed assistants, connections, image providers, git hosts and private-only repositories, deployed with MDM or Group Policy.
  • Your company’s AIClaude through Amazon Bedrock, Google Vertex AI or Microsoft Foundry, or an Anthropic or OpenAI enterprise API key.
  • Audit log on each computerBuilds, images, pushes, publishes and connection changes, with time, user and host.
  • Proxies and certificatesWorks behind TLS-inspecting proxies with the certificates IT installed.
  • Keys in the OS keychainNever in chat, never in the repository, never sent to Jig.
  • Update control per organizationStable or beta channel, version pinning, a minimum version and staged rollouts.
  • Organizations by email domainPeople join your organization automatically when they sign in with a work address.

Coming next

  • Company templatesIT or a design lead publishes approved starting points with your design system, sign-in, data connections and hosting. Everyone starts there instead of a blank page.
  • Shared libraryCompany skills, components and brand kits shared across the organization, so every app looks and works like yours.
  • Admin dashboard for ITSeats, who is using Jig, versions in use, and the update channel and rollout for each team.
  • Single sign-on and audit exportSAML or OIDC with Okta or Entra ID, and audit logs exported to your SIEM.
  • Policies from the cloudPush policy to every computer from Jig Cloud, without MDM files.
  • Publish to your company hostingVercel, Cloudflare Pages, GitHub Pages and Azure Static Web Apps.

What leaves the computer

Four possible destinations. Only one of them is Jig, and it never sees the work.

The employee’s computer
  • Projects and git history
  • Running previews
  • Keys, in the OS keychain
  • The audit log
  • The AI provider you choosePrompts and the files the AI needs for the task. Anthropic, OpenAI, or your own Bedrock, Vertex AI or Foundry account.
  • Your git server and hostingCode, only when someone pushes or publishes, with their own access.
  • Jig CloudWho signed in, plan and organization, Jig version, OS and update checks.
  • Never to JigCode, prompts, AI output, keys, connection tokens or backups.

Questions from IT

Which AI coding assistants does Jig work with?

Claude Code and OpenAI Codex, plus opencode for other models such as OpenRouter, Google, Groq or local models through Ollama. Claude Code has the deepest integration today. Companies can route Claude through Amazon Bedrock, Google Vertex AI or Microsoft Foundry, or use an Anthropic or OpenAI enterprise API key. The policy file decides which of these people may use.

Where is our data stored?

Projects, history and keys stay on the employee’s computer. Prompts go to the AI provider and region you choose, such as your own Bedrock region. Jig Cloud stores account details (email, plan, organization, install and version) in the United States.

Does Jig work offline?

Editing projects does; building needs your AI provider to be reachable. Jig checks in with Jig Cloud every six hours. After 14 days without a check-in it asks the person to sign in again. Projects are never locked: they are ordinary folders.

Where do the installers come from?

From the download page on jigit.dev, which hands out a short-lived link to Jig’s release storage. Updates come from Jig’s own update service and follow your organization’s rules. Mac builds are signed. Apple notarization and Windows code signing are coming soon.

How do we deploy it at scale?

Push the installer with your software distribution tool and the policy file with your MDM or Group Policy: /Library/Application Support/Jig/policy.json on macOS, %ProgramData%\Jig\policy.json on Windows, /etc/jig/policy.json on Linux. Set the cloud AI environment variables centrally if you like; Jig respects them. We set your organization’s update channel and rollout with you.

Can we collect the audit log?

Yes. Each computer writes one JSON line per event to ~/.jig/audit.jsonl. Collect it with your usual endpoint log shipper.

How strict is local enforcement?

The policy is enforced by Jig’s local service, so people can’t switch it off in Settings. As with any desktop software, someone with admin rights on their own machine can change local files. Update rules and paid features are decided by Jig Cloud, not the computer.

Pilot it with one team.

We’ll help you set the policy, the AI provider and the update channel. Jig is free to try today.

Talk to usDownload Jig