Security Policy

The short version

The App has no backend of its own. It runs entirely on Atlassian infrastructure under the Runs on Atlassian programme, holds no credentials, exposes no public endpoints, and sends no data to any third party.

Most of the questions a security review asks are answered by that one architectural fact.

Architecture and attack surface

• No vendor-operated servers. All code executes in Atlassian's Forge runtime inside the customer's tenant boundary. AXONZO SRL operates no servers, databases, or log sinks that receive customer data.
• No egress. The App declares no remotes in its manifest and makes no outbound network calls. Verified with forge eligibility, which confirms Runs on Atlassian compliance.
• No public API. The App exposes no REST endpoints of its own. Its only entry points are Forge resolvers, invoked by Atlassian and authenticated by the platform.
• No secrets. The App never asks users for Personal Access Tokens, passwords, or any other shared secret. All Jira access uses the OAuth grant the site admin approves at install time.
• Read-only Jira access. Requested scopes are read-only: read:jira-work, read:jira-user, read:project:jira, read:board-scope:jira-software, read:sprint:jira-software, plus storage:app for the App's own settings. The App cannot modify or delete anything in Jira.
• Least-privilege calls. Jira is queried as the signed-in user (asUser), so the App can never surface an issue that the person looking at the report is not already permitted to see.

Data handling

The App stores only its own configuration — working calendar, risk thresholds — in Atlassian Forge Storage. It does not copy, cache, or persist issue data; reports are computed per request and discarded.

Application logs record counts and timings only, never issue content, identifiers, or personal data.

Full detail is in the Privacy Policy.

Secure development

• Every release is deployed through the Forge CLI; there is no manual access path to production.
• Dependencies are limited to the Atlassian Forge SDK and Atlassian's own UI Kit.
• Source is version-controlled, and each production deployment corresponds to a tagged commit.

Reporting a vulnerability

Email [email protected] with the subject line SECURITY. Please include a description, reproduction steps, and the impact you believe it has.

• We acknowledge reports within 3 business days.
• We aim to provide an assessment and remediation plan within 10 business days.
• We will keep you informed until the issue is resolved, and credit you on request once a fix has shipped.

Please do not disclose the issue publicly until we have had a reasonable opportunity to address it. We will not pursue legal action against researchers who report in good faith and avoid privacy violations, service disruption, or data destruction.

Incident response

If an incident affects customer data, we will notify affected customers at the contact address on their Marketplace subscription without undue delay, describe what happened and what data was involved, and state the remediation taken.

Scope and limits

This policy covers the App itself. The security of Jira Cloud, Atlassian Forge, and Atlassian's infrastructure is Atlassian's responsibility; see Atlassian Trust Center.

We hold no compliance certifications (SOC 2, ISO 27001) at this time and do not claim any. We have not completed a CAIQ Lite questionnaire; if your procurement process requires one, contact us and we will complete it for your review.