Security policy for our Atlassian apps

• No servers of our own. The apps run on Atlassian Forge, inside Atlassian's cloud. We have no copy of your data and no way to reach it from outside Atlassian.
• Stored in your data region. Everything an app keeps is in Forge hosted storage, in the same data residency region as your Atlassian site.
• Encrypted at rest and in transit. Atlassian encrypts Forge storage at rest. All traffic between your browser, your site and the app uses HTTPS (TLS), handled by Atlassian.
• No outbound connections. None of the apps declares an external host, so Forge blocks any request to a server outside Atlassian. No data is sent to us or to any third party.
• No keys or tokens to leak. The apps sign in through Forge's built-in authentication. They create no API tokens and hold no secrets.
• Minimum data. We store account IDs, not people's names or email addresses. Names and emails are read from Atlassian when a page shows them and are never written to storage. The apps never store issue or page content, comment text or attachments. The one exception is the Secret & Personal Data Scanner: it keeps the line around each finding and the page title, with every value it finds masked, so the other words there can still include a name.
• Logs without personal data. The apps log IDs, counts and errors only, never personal data, credentials or tokens. Only the app's developers can see its logs.
• AI stays inside Atlassian. Some apps include a Rovo agent. Rovo is Atlassian's own AI, and these agents can only read the app's results. We send no data to any other AI service.
• Removed on uninstall. When you uninstall an app, Atlassian deletes its stored data under Forge's data deletion rules. We confirm deletion in writing on request.

• Source code is kept in private repositories, never only on a laptop.
• Every release is tested on a development install first. Before it goes to production, the unit tests must pass, forge lint must be clean, and npm audit must show no known vulnerabilities in production dependencies.
• We keep dependencies to a minimum: Atlassian's official Forge packages and our build tools.
• We follow the OWASP Top 10. Every request is validated, input is accepted only from fixed lists where possible, and values placed into Jira or Confluence queries are always quoted.
• Each permission is justified in the app's manifest and on its Marketplace listing. We do not add a permission an app doesn't use.

We keep a written incident response plan. If an incident could affect customer data, we:

• contain it first, for example by disabling the affected feature or removing access;
• tell Atlassian within 24 hours;
• tell affected customers within 72 hours: what happened, what data was involved, what we've done and what you should do;
• fix the cause, and write up what we changed so it doesn't happen again.

Our source code is kept in private repositories, so any app can be rebuilt and redeployed quickly from a known good version.