We use jenkins for CI, but only on our QA server. I haven't found a way to do CI without giving Jenkins full credentials on our server.

Jenkins is very powerful, but I would not trust it (or any of the myriad plugins we have installed) to not have security holes.