What the app reads, what it keeps, and what it never changes.

The app reads the following from your Jira Cloud site, using the permissions granted at installation:

• Request data (read Jira work): each time the panel is shown, the request's project and only the fields an administrator chose, its assignee, SLAs and links if those are turned on, and its reporter, participants, organizations and request type, to check who may see it. For linked requests: their key, title, status, reporter, participants, organizations and request type. For the settings page: the site's field list, link types, and the keys and titles of the 15 newest requests the administrator can see, for the preview.
• Service projects and requests (read service desk requests): the list of service projects, their request types and portals, and, for the preview, the request chosen and who raised it.
• Organizations (read organizations and organization members): which organizations a customer belongs to, confirmed against each organization's member list, so a request shared with an organization is shown only to its members.
• User directory data (read Jira users): account IDs of the viewer, reporter and participants for the checks; the assignee's display name when the panel shows it; the display name of whoever saved the settings last; and, in the preview, the name of the person who raised the request. Of these, only the account ID of whoever saved last is written to storage.

Values are reduced to the words a person would read before they reach the portal. Email addresses, avatar links and internal IDs in a field value are dropped. The app does not read comments, attachments or work logs.

The app stores, in Forge's Atlassian-hosted storage within your site's data residency region:

• One settings record per service project: field IDs and names, SLA IDs and names, the labels an administrator typed, link type IDs, the choice made for each request type, the project's ID, key and name, its portal IDs, the revision number, and the account ID of whoever saved last, with the time.
• For five minutes after each save, a claim on that revision number, so two saves at the same moment cannot both win.
• For a project whose settings were turned off, its last revision number.
• The IDs of three Jira Service Management fields (participants, organizations, request type).
• Which service project each Jira project is, and which service project each portal belongs to.
• When the first save happened on the site, and whether the review note was closed.

Nothing about any request or customer is stored. The panel reads the request each time it is shown. Display names are not stored; they are read from Jira each time they are shown.