Trust Center

Last updated: October 12, 2026

This Trust Center provides a transparent overview of the security practices, data handling, and privacy principles that apply to all apps published by Janek Behrens on the Atlassian Marketplace. It is intended to help customers, administrators, and security teams evaluate the trustworthiness of our apps before and after installation.

1. About the Vendor

Janek Behrens is an independent Atlassian Marketplace Partner developing productivity apps for Atlassian Cloud products. All apps are built exclusively on the Atlassian Forge platform. All seven are live on the Atlassian Marketplace.

2. Infrastructure & Hosting

All apps are built on Atlassian Forge, Atlassian's native cloud development platform. This means:

• App code runs entirely within Atlassian's infrastructure — there are no third-party servers, no external cloud providers, and no infrastructure operated by Janek Behrens.
• App logic runs within the Forge runtime on Atlassian's infrastructure. Where an app makes outbound calls (e.g., to AI or Git providers you configure), these are made via Forge's allowlisted external fetch mechanism — not through any infrastructure operated by Janek Behrens.
• Apps without outbound calls qualify for the Runs on Atlassian designation, meaning Atlassian provides the underlying security, availability, and compliance guarantees for the hosting layer. CodeDoc does not qualify, because it connects to the Git and AI services you configure.

For Atlassian's own infrastructure security and compliance certifications (ISO 27001, SOC 2, etc.), refer to the Atlassian Trust Center.

3. Data Privacy Principles

All apps adhere to the following data privacy principles:

• Data minimization: Apps only request the Atlassian API scopes strictly necessary to deliver their functionality. No speculative permissions are requested.
• No personal data on our systems: Apps do not collect, transmit, or store personally identifiable information (PII) such as names, email addresses, user keys, or account details on any system controlled by Janek Behrens. Some apps keep a little personal data in Atlassian Forge Storage for your site, such as Atlassian account IDs, display names or, in CodeDoc, the name of the Git account behind a Git connection; the app overview below and each app's Privacy Policy say exactly what.
• No data sent to servers of Janek Behrens: No app transmits any data to servers operated by Janek Behrens. Any external calls made by an app go exclusively to services that you explicitly configure using your own credentials (Bring Your Own Key model), to public package registries for CodeDoc's optional version check (public package names only), or to no external services at all. See the app overview table below for details per app.
• Technical logs: Like most Forge apps, each app writes technical log lines and anonymous daily usage counters to Atlassian's app logging, which Atlassian makes available to us as the app vendor. They may contain IDs and keys from your site (for example project keys), but never names of people or account IDs; each app's Privacy Policy lists what they may contain.
• No tracking: Apps do not use cookies, tracking pixels, session recording, analytics platforms, advertising networks, or any form of per-person behavioral analytics. The only usage data is the anonymous daily usage counters described above.
• Data in Atlassian storage only: Apps store data only in Atlassian Forge Storage — such as settings, mappings, credentials you provide, job history metadata, caches, computed results and progress snapshots that page editors publish (Epic Progress for Confluence, without person fields such as assignees or account IDs); each app's Privacy Policy lists what it stores. This data resides on Atlassian's infrastructure. Values an app writes into Jira or Confluence, such as progress or score values in the app's own custom fields or CodeDoc's documentation pages, are stored by Jira or Confluence itself. After an app is uninstalled, Atlassian keeps its stored data for 28 days and then deletes it; within 21 days of the uninstall, you can ask us to have Atlassian restore it to a new installation of the app.

4. App Overview

For app-specific details on data access, storage, and retention, refer to the individual Privacy Policy linked above for each app.

5. GDPR Compliance

All apps are designed to be compliant with the General Data Protection Regulation (GDPR) and applicable data protection laws. Key measures include:

• Lawful basis: Data access is based on the legitimate interest of delivering the app's contractual functionality to the installing organization.
• Data subject rights: Since no personal data is stored outside the Atlassian platform, data subject requests (access, rectification, erasure, portability) can be addressed by uninstalling the app (Atlassian deletes its stored data 28 days later) or contacting us directly.
• Data processing location: All data is processed within Atlassian's infrastructure, except what CodeDoc sends to the Git and AI providers you configure and, for its optional version check, to public registries (see section 8). Atlassian provides GDPR-compliant data processing agreements as part of its standard terms. Apps do not introduce sub-processors beyond those listed in section 8.
• Breach notification: In the unlikely event of a security incident affecting app-related data, affected customers will be notified in accordance with GDPR Article 33/34 requirements and applicable law.

6. Data Flow

The diagrams below show exactly how data moves when each app runs. No data passes through infrastructure operated by Janek Behrens at any point.

Team Capacity Planning for Jira

All data stays within Atlassian infrastructure. No external calls.

Visual Progress Tracker for Jira

All data stays within Atlassian infrastructure. No external calls.

DevOps Metrics for Jira

All data stays within Atlassian infrastructure. No external calls.

Velocity Chart for Jira

All data stays within Atlassian infrastructure. No external calls.

CodeDoc for Confluence

Blue = Atlassian infrastructure   |   Orange = services you configure with your own credentials

Priority Scoring for Jira

All data stays within Atlassian infrastructure, Rovo AI included. No external calls.

Epic Progress for Confluence

All data stays within Atlassian infrastructure. No external calls.

7. Data Processing Agreement (DPA)

All data processing occurs within Atlassian's platform (Forge runtime, Forge Storage, Jira and Confluence APIs). Atlassian acts as the data processor for this infrastructure layer, governed by Atlassian's Data Processing Addendum, which is part of Atlassian's standard Cloud Terms of Service.

For CodeDoc: outbound calls to your Git and AI providers are made using credentials you supply (Bring Your Own Key). You hold the direct contractual relationship with those providers — Janek Behrens is not a party to that data flow. With Atlassian AI (Advanced edition), AI pages are processed on Atlassian's platform under Atlassian's terms.

If your organization's procurement process requires a written confirmation of this arrangement, please contact support@janekbehrens.de.

8. Subprocessors

The table below lists all third-party services involved in data processing per app. "Customer-configured" means Janek Behrens has no contractual relationship with that provider — you supply your own credentials and your organization is the controller of that connection.

This subprocessor list is reviewed and updated whenever a new integration is introduced. Last reviewed: October 8, 2026.

9. Compliance & Certifications

Janek Behrens does not independently hold SOC 2 or ISO certifications. However, because all apps run exclusively on Atlassian Forge, they operate within Atlassian's certified infrastructure. Atlassian maintains the following certifications for its cloud platform:

Full certificates and audit reports are available via the Atlassian Trust Center.

In addition, all apps undergo Atlassian's Marketplace security review before each version is made publicly available. This includes automated security scanning, scope justification review, and privacy guideline compliance checks.

10. Security Practices

All apps are developed following Atlassian's security guidelines for Marketplace Partners:

• Least privilege: Only the minimum required Atlassian API scopes are requested. Permission justifications are provided during the Marketplace approval process.
• Sandboxed execution: Forge apps run in a sandboxed environment with no access to the underlying host system.
• No credential storage: Apps do not store API keys, tokens, passwords, or secrets — except CodeDoc, which keeps the Git access tokens, AI keys and webhook secret you enter in Atlassian Forge's encrypted secret storage, readable only by its backend.
• Dependency management: Dependencies are kept up to date to minimize exposure to known vulnerabilities.
• Atlassian security review: All versions submitted to the Atlassian Marketplace undergo Atlassian's security review process before becoming publicly available.

11. Vulnerability Disclosure

If you discover a security vulnerability in any of our apps, please report it responsibly by contacting us directly at the email address below. We commit to:

• Acknowledging your report within 2 business days.
• Investigating and addressing confirmed vulnerabilities in accordance with Atlassian's security bug fix SLAs.
• Keeping you informed of progress during remediation.

Please do not publicly disclose vulnerabilities until a fix has been released.

12. Atlassian Marketplace Compliance

All apps comply with the Atlassian Marketplace App Approval Guidelines and the Atlassian Data Privacy Guidelines for Developers. Each app version is reviewed and approved by Atlassian before being made available to customers.

13. Changes to This Document

This Trust Center may be updated as new apps are published or practices evolve. Material changes will be reflected in the "Last updated" date above. We recommend periodically reviewing this page if you have ongoing compliance requirements.