Security for Helkrypt Atlassian apps

• Every app is built on Atlassian Forge and hosted by Atlassian. I run no servers of my own for the apps.
• The apps send no data outside Atlassian: no external services, no analytics, no tracking. Where an app uses AI, it is Atlassian's built-in Forge LLMs service, which runs inside Atlassian.
• Apps store only what they need, such as settings, templates and rules, in Atlassian's app storage. Storage is separate for each Jira site, so data cannot pass between customers.
• App data is deleted by Atlassian when the app is uninstalled, as described for each app.

• Data in transit between Jira, the app and Atlassian's platform uses TLS.
• Data in Atlassian's app storage is encrypted at rest by Atlassian.
• The apps keep no passwords or API tokens. If a secret is ever needed, it is kept only in Atlassian's encrypted app variables.

• Each app asks for the smallest set of Atlassian permission scopes it needs. The scopes are listed and explained on each app page.
• Actions are checked against the user's own Jira permissions. Settings pages are limited to Jira administrators.
• Every request to an app checks the subscription and validates its input.
• Logs hold IDs, status codes and event types only. They hold no work item content and no personal data.

• Before each release, every app passes a dependency audit with no known vulnerabilities in production dependencies, unit tests, and a security review of the code.
• Dependencies are checked automatically every week.
• I fix confirmed vulnerabilities within these time limits:

Helkrypt AI AS holds no security certifications of its own. The apps run on Atlassian's cloud platform. Atlassian's own certifications are listed at https://www.atlassian.com/trust.

Email support@helkrypt.nowith "Security" in the subject. Describe the app, what you found and how to reproduce it. I reply within one business day. If a security incident affects your data, I tell the affected customers without undue delay.