Since 2009
TELCOMA Global / Access Review for Jira / Privacy policy
What the app reads, what it keeps, and what it never changes.
This policy describes what Access Review for Jira does with your data.
1
What the app is
Access Review for Jira ("the app") is an Atlassian Marketplace app that helps a Jira Cloud administrator review who has access to the site. It takes a snapshot of group membership, product access, admin status and recent activity, records the administrator's decision for each person, records who signed the review off, and produces an evidence file. It runs entirely on Atlassian's Forge platform and is read-only.
2
What data the app processes
The app reads the following from your Jira Cloud site, using the permissions granted at installation:
- User directory data: account ID, active status and account type while a review is built; display name and email address (where the user's Atlassian profile makes it visible to apps) when the review is displayed and in the evidence file an administrator downloads. None of these except the account ID are written to storage.
- Groups and application roles: every group on the site, its members, and which groups give access to each Jira product.
- Issue activity metadata: for recently updated issues, the author and timestamp of changelog entries, comments and work logs, and the creator and reporter. The app reads this to determine who was active and when. It does not read issue descriptions, comment text, attachments or custom field values.
3
What the app changes
Nothing. The app has no write permission. It cannot change group membership, deactivate accounts, or alter any setting, issue or configuration. Acting on a decision happens outside the app.
4
What data the app stores
The app stores, in Forge's Atlassian-hosted storage within your site's data residency region:
- Review progress (cursors, counters, timestamps).
- For each person in each review: the Atlassian account ID, the IDs and names of their groups, the products those groups grant, whether any group is an admin group, the date of their most recent activity in the window or an inactivity band, and whether they were new since the previous review.
- Decisions: the decision (keep, remove or follow up), the note the administrator typed (up to 500 characters), and the account ID of the administrator who decided and when.
- Review metadata: who started and who signed off each review and when, the counts, and the changes compared with the previous signed-off review.
Display names and email addresses are not stored; they are read from Jira each time they are shown. The app never stores issue content, comment text, work log descriptions, attachments, or any text authored by your users. Notes are written by your administrators; please keep them factual, as they form part of the evidence file.
5
Where data goes
Nowhere. The app makes no network requests outside Atlassian and has no servers of its own. Data does not leave your Atlassian site's hosting region. The evidence file is generated in the administrator's browser and saved to their device; what happens to it after that is under your control.
6
Legal basis and roles
You (the customer) are the data controller for the personal data on your site. TELCOMA Global is a data processor acting on your instructions, which consist of installing the app, starting reviews, recording decisions and signing off. Where the GDPR applies, the app's processing is performed under your instructions and on Atlassian's infrastructure.
7
Retention and deletion
The app keeps the 12 most recent reviews; older reviews are deleted automatically. An administrator can delete any review from the Past reviews tab. When the app is uninstalled, Forge deletes all app storage for your site. You may also request deletion by contacting us.
8
Security
The app runs on Atlassian Forge, which enforces the app's permissions at the platform level, hosts its storage, and isolates it from other apps. Every permission it holds is read-only. Only Jira administrators can open the app. Security issues may be reported to [email protected]; please do not post them publicly.
10
Changes to this policy
We will update this policy when the app's data handling changes and note the effective date above.