It is the case with all Cloud instances that some screens can be displayed without logging in (if someone knows the instance address). They don't expose much information, but still, the company logo (if added) is there, as well as the fact that JIRA Agile is active:

• https://<instance>/secure/RapidStart.jspa
• https://<instance>/secure/Dashboard.jspa
• https://<instance>/secure/ManageFilters.jspa

Privacy-wise, it would be better if any anonymous user that shouldn't have access to the instance was automatically redirected to the login page upon attempting to open the above screens.