Trust center
Effective October 28, 2026
The short version
- TreeCraft runs on Atlassian Forge and keeps its data in your own Jira site's Forge storage. It declares no outside network access.
- The only subprocessor is Atlassian.
- App logs hold ids, counts, statuses and error codes. They never hold work item content.
- These documents are available in English and French.
These pages describe how TreeCraft: Issue Hierarchies handles security, privacy and data. They are written for security reviewers, privacy officers and Jira admins. The last column shows which requirement of the Atlassian Enterprise Certified program each document is meant to answer.
Documents
| Document | What it covers | Atlassian Enterprise Certified |
|---|
| Security overview | Response commitments, fix deadlines, security practices (development, access control, data minimisation, encryption at rest, backups, planned penetration test and bug bounty), the permissions the app asks for. | Section 1, Security (including 1.6, 1.13, 1.16); 2.2; 2.3 |
| Vulnerability Disclosure Policy | How to report a vulnerability, what is in scope, safe harbour, and what to expect from us and when. Also published as security.txt. | 1.2, 2.2 |
| Architecture Diagram and Data Flow | A diagram of the app, every data flow, and the network connections. Password protected: request access at info@plugincraft.ca. | 1.3 |
| Data Logging | What the app's logs hold, what they never hold, and how long they are kept. | 1.9 |
| Data Handling: Retention and Deletion | What the app stores, where, how long, and how it is deleted. | 3.4 |
| Incident Response | How incidents are detected, triaged, classified, resolved and reviewed. | 2.1 |
| Privacy policy | How personal information is handled on this website and in the app. | 3.5 |
| VPAT: Accessibility Conformance Report | Accessibility conformance against WCAG 2.2 Level A and AA. Password protected: request access at info@plugincraft.ca. | 4.1 |
| AI Usage Policy | How the app uses AI, which runs on Atlassian's Rovo. | 5.1 |
| Subprocessors | Who may receive data when the app runs. | 1.12 |
At a glance
| Runs on | Atlassian Forge (Node.js 22), built to Atlassian's Runs on Atlassian requirements |
|---|
| Where data is kept | Forge SQL, and Forge key-value storage for timeline baselines only, in your Jira site's data residency location, one set per installation. Jira keeps small search tokens on work items when search is turned on for a hierarchy. |
|---|
| Outside network access | None declared: no egress, no remotes, no Connect modules, no web triggers |
|---|
| Subprocessors | Atlassian only |
|---|
| Languages of the app | English, French, German, Italian, Spanish, Simplified Chinese, Japanese and Hindi |
|---|