Its one thing to use this service on the basis of encryption claims - its another thing to have to clean up the mess from a forgotten API key being leaked somewhere... is there, therefore, a third party involved in an audit of Jazz?
Of course we will also do public audit(s) with security companies to make sure our cryptographic protocols are sound and implemented correctly.
But, it also has to be stated, there is no guarantee that you're using only the open source components you've declared, which is why an impartial audit by a third party would be necessary before this project can be used to build products in some industries.
Anyway, I see that you have other concerns, so no worries and thanks for the honest answer.