Security and privacy
What happens to your data when you use our apps, and how we protect it. The details for each app are in its documentation.
Where our apps run
Our apps are built on Atlassian Forge and run entirely on Atlassian's infrastructure. We have no servers of our own, and the apps send no data to us or to any other outside service.
Atlassian stores and processes the apps' data as our sub-processor. App data is kept in Forge hosted storage, in the same location as your Jira site's data, and moves with it when your administrator moves Jira to another location.
Personal data
Issue Link Guard stores only Atlassian account IDs. It stores no names, email addresses, passwords or issue content. Your Jira administrator decides how long its activity log is kept, and can anonymize it or turn it off.
For the data our apps process in your Jira site, we act as a processor for the organization that installed the app. The terms are in our Data Processing Addendum.
Our security practices
- Multi-factor authentication protects our Atlassian developer account, our GitHub account, and the OVHcloud account that manages our email. Our mailboxes use strong, unique passwords.
- Only the business owner has access to these accounts.
- We scan every change with Forge Security Requirements Tester, Atlassian's security scanner for Forge apps, and audit dependencies for known vulnerabilities.
- We don't access customer data outside the apps' normal operation. The app logs we read to diagnose problems contain no personal data.
Report a vulnerability
Write to security@btb-it.com. Describe the problem and the steps to reproduce it, and don't disclose it publicly until we've released a fix. We confirm receipt within 2 business days and keep you updated until the vulnerability is fixed.
Our fix targets follow Atlassian's Security Bug Fix Policy for cloud apps:
| Severity | CVSS score | Fixed within |
|---|---|---|
| Critical | 9.0 to 10.0 | 10 days |
| High | 7.0 to 8.9 | 4 weeks |
| Medium | 4.0 to 6.9 | 12 weeks |
| Low | 0.1 to 3.9 | 25 weeks |
Security incidents
If a personal data breach affects your organization's data in one of our apps, we notify your organization through the technical contact of its license without undue delay and no later than 72 hours after we become aware of it. We also report security incidents to Atlassian, as Atlassian requires.
Documents
Privacy questions: privacy@btb-it.com