Auditor-Ready in Three Days: Jimini AI

Jimini AI puts AI in the hands of thousands of European lawyers, holding highly confidential client information. Jimini's ISO 27001 program includes an annual independent security assessment. Instead of working around a testing firm's calendar, Stéphane Béreux launched a full whitebox assessment with XBOW on the day he chose and had an auditor-ready report three days later.

Key takeaways

• Jimini gave XBOW full source code because Stéphane wanted the strictest assessment available.
• After launch the assessment ran unattended, with no scheduling and no work from Jimini's side.
• The assessment was cost-effective enough to run more than once a year.

Background

Stéphane Béreux co-founded Jimini AI and runs its technology. The product handles contracts, legal research, and privileged client work, so he sets the security bar himself and keeps it high.

Jimini builds an AI copilot for lawyers and legal professionals, automating the manual work of legal practice inside one tool that connects to the systems firms already use. It launched in January 2023 and is based in Paris, serving more than 15,000 legal professionals across a dozen European countries.

Challenge

ISO/IEC 27001 is the international standard for information security management. In Europe it carries the weight SOC 2 carries in the US. For a company holding contracts and privileged client files, certification tells a law firm that Jimini protects its data to a recognized bar.

Keeping that certification means proving the controls every year, and Jimini's program includes an annual penetration test. Renewal was approaching.

Stéphane runs that program himself. Meeting the annual requirement usually means booking a firm and working to its calendar. Good testers are worth booking, but the calendar is theirs, and Stéphane wanted it to be Jimini's.

Why XBOW

Stéphane first heard about XBOW from a French company whose CTO had written about using it for their own security assessment. He read XBOW's track record and benchmark results, and the case made sense to him.

He could start the assessment the moment he was ready, without waiting for a slot on anyone's calendar.

Solution

Jimini committed to the strictest test on offer. Stéphane handed over the full source code so XBOW could assess the application with complete visibility. He made that choice because he trusted what his team had built and wanted to see how it held up under real attack conditions.

Setup took some back-and-forth. XBOW ran an onboarding session, and support resolved a snag with the source-code format. After that, the assessment ran without further work from Jimini's side, while the team kept shipping product.

Results

The report landed three days after launch. Stéphane pulled it into Jimini's certification file and singled out how easy it was to read and act on.

Stéphane also asked XBOW for a one-page attestation confirming the assessment was carried out and that no findings remained open afterward. Jimini keeps that letter with its audit evidence and sends it to clients who ask how their data is protected.

Looking Ahead

Stéphane plans to run XBOW at least once a year to keep the certification current. Jimini is also building continuous, AI-assisted code review into its own development process, alongside the periodic tests, so new issues surface closer to the moment someone introduces them. As the company grows, he wants to test more often.

About

Jimini AI is an AI platform for lawyers and legal professionals, centralizing legal analysis, drafting, and research in one tool. Founded in January 2023 and based in Paris, Jimini AI serves more than 15,000 legal professionals across a dozen European countries. jimini.ai

XBOW is the autonomous offensive security platform that proves what attackers can exploit. By launching real attacks and independently validating every finding, XBOW helps security teams prioritize real risk and secure applications continuously with the controls enterprises require for production environments. xbow.com