🛡️ Security Policy – Issue Delivery Report

Built with security-first principles — powered by Atlassian Forge.

🧱 Forge Sandbox Architecture

Issue Delivery Report is built entirely on Atlassian Forge, which guarantees:

• 🔒 Code isolation per app and per site

• 🌍 Data residency within Atlassian’s secure cloud infrastructure

• 🧾 Strict API scope enforcement declared via the Forge manifest

• 🚫 No external servers, databases, or custom backends

All logic runs inside Atlassian’s serverless runtime. We never host or execute code outside of the Forge environment.

🔐 Permission Scopes

We only request minimal scopes required for functionality — nothing more.

🛑 No write:jira-work or issue mutation occurs in this app — we never modify issues or fields.

🗂️ Data Residency

All runtime operations and temporary data handling occur inside Atlassian’s platform.

• No part of the app transmits or stores data outside Jira

• No external analytics, telemetry, or storage are involved

Exports (CSV, JSON, MD, TXT) are generated in the user’s browser, not sent anywhere.

🔍 No Secrets Stored

Issue Delivery Report does not use:

• ❌ Environment variables

• ❌ Secret tokens

• ❌ User credentials

• ❌ External endpoints

All logic is performed in a secure session scoped to the current issue.

👥 User Data Access

We only access:

• displayName of the user who changed issue statuses (for audit clarity)

We do not access:

• Email addresses

• Full user profiles

• Jira internal account IDs

🧪 Secure Development Process

We follow strict practices during development:

• ✅ Mandatory code reviews for all changes

• ✅ Scope-based testing in sandbox environments

• ✅ Static analysis using ESLint + Forge validators

• ✅ Manual verification via forge tunnel before deployment

✅ Atlassian-Backed Security

As a Forge app, Issue Delivery Report inherits Atlassian’s platform-level protections:

• ✅ SSO authentication with your Jira Cloud instance

• ✅ OAuth2-secured API calls via requestJira()

• ✅ Per-tenant data isolation

• ✅ Enforced runtime boundaries

• ✅ Aligned with ISO/IEC 27001, SOC 2, GDPR, and CCPA

🧩 Questions about security or compliance?
Reach out to: support@typeswitch.net — we’re happy to provide clarification or assist with vendor risk assessments.