Trust center

No. The app runs on Atlassian Forge and declares no outside network access: no egress, remotes or Connect modules, and a test fails the build if any is added. Data crosses Atlassian's boundary only when you choose: if you turn on the automatic scan, a sender you run pushes the redacted scan into the app (the app sends nothing out), and an admin can send us a support bundle. The sender first reads the rules' real text through Atlassian's API, on the system you choose, which may be ScriptRunner Cloud, a script app from another publisher that you installed. See Subprocessors.

No. Each text in a flow's settings (JQL, web addresses and headers, email addresses, smart values, custom field names, values compared, comments and secrets) is replaced by a placeholder in your browser, or in your own sender, before anything is sent. The app refuses a flow that is not redacted. Flow names are not settings: they reach the app and are kept. A flow's JQL goes only to your own site's Jira, to be checked and counted. If you use the automatic scan, its sender reads the rules' real text first, with your own Atlassian API token, wherever you run it (as a scheduled job in ScriptRunner Cloud, a script app from another publisher, if you chose one). The token never reaches the app. See Data minimisation.

Only the people your Jira admins allow: Jira admins, the groups they allow, and a project's admins for that project. The clean-up tools are for Jira admins only. Everything the app reads or changes in Jira as a person is done with that person's own Jira rights. Alerts are created, and the background checks read, as the app. See Access control.

The app sends no data to Plugincraft. What we can read of the app is technical: its logs (ids, counts, statuses and error codes only), the usage metrics Atlassian shows a publisher for each site, the licence and contact details Atlassian's Marketplace gives us, and a support bundle if an admin chooses to send one. See Data Logging and the privacy policy.

No. Atlassian gives apps no access to Jira automation rules, to read or to change. TuneCraft works from the export of your rules, or from what a sender you run pushes, and prepares a corrected flow that you import in Jira yourself.

The app keeps no copy outside your installation. When an admin uninstalls it, Atlassian keeps its stored data for 30 days and then permanently deletes it. A request made to Atlassian within 21 days of the uninstall can relink a reinstall to the old data. See How data is deleted.

Not yet for Plugincraft itself. TuneCraft keeps all its data inside Forge, so its hosting, storage, encryption and infrastructure controls are Atlassian's, covered by the Forge platform's SOC 2 attestation and ISO/IEC 27001 certification. Those are Atlassian's certifications for the platform, and they cover only part of what SOC 2 and ISO 27001 ask for, for data inside Forge; the rest are the company's own processes. Plugincraft has not yet completed its own SOC 2 or ISO 27001 audit; a SOC 2 Type II audit is planned. See inherited controls and Atlassian's page on what Forge apps inherit.

Not yet. After the app is listed on the Atlassian Marketplace, we plan to have it tested once a year, through Atlassian's penetration test program or by a CREST-accredited provider, and to join Atlassian's Marketplace Security Bug Bounty program. See Penetration test and bug bounty.

Only through its Rovo helper, which runs on Atlassian's platform with Atlassian's model. The app calls no AI service outside Atlassian, the helper reads with the asking person's permissions, and it changes nothing in Jira. Plugincraft receives none of the data, so it cannot use it to train a model. See the AI Usage Policy.

Write to info@plugincraft.ca, in English or French, and put "URGENT" at the start of the subject line for an urgent matter. We acknowledge a report within 2 business days and fix vulnerabilities within the deadlines of Atlassian's Security Bug Fix Policy. See the Vulnerability Disclosure Policy.