Security Policy

Velocity Chart for Jira · Last updated: October 12, 2026

1. Overview

Velocity Chart for Jira ("the App") is built on the Atlassian Forge platform and operates entirely within Atlassian's infrastructure under the Runs on Atlassian trust boundary. The App is read-only, makes no outbound network calls to any external server, and stores no credentials of any kind. This document describes the App's security architecture and our practices.

2. Architecture & Runtime Environment

• No developer-operated servers: There is no external backend, database, or infrastructure operated by us. All compute and storage is provided by Atlassian.
• Sandboxed execution: Forge functions run in isolated, sandboxed containers with restricted system access managed by Atlassian.
• No external network egress: The App declares no egress domains and makes no outbound requests to any server outside the Atlassian platform. No external API keys or third-party services are involved.
• No AI: The App does not use any AI service. It performs deterministic arithmetic on sprint data only.

3. Access Control

4. Data Protection

Data in transit:

• All Forge-to-Jira API calls use Atlassian's internal secured transport (TLS 1.2+).
• The App makes no outbound HTTPS calls to external services.

Data at rest:

• Only a short-lived cache of the sprint data per board (sprint names and dates; issue IDs, keys, estimates and statuses; expires after one hour), a board-to-project ID map and field discovery data (numeric field IDs and names), the date of the first chart and anonymous daily usage counters are stored in Atlassian Forge Storage (KVS), hosted by Atlassian with encryption at rest and data residency in the location of your Jira site. The sprint data cache is shared by everyone on the site and filtered by each viewer's permissions before it is shown.
• No credentials, tokens, or secrets are stored — there are none to store.
• Issue content (titles, descriptions, comments) and any personal/user data are never stored.
• After an uninstall, Atlassian keeps the App's storage for 28 days and then deletes it; retention is described in the Privacy Policy.

Technical logs:

• Log lines contain only numeric board IDs, counts, modes, cache hits, durations, HTTP statuses and error codes. They never contain board, sprint or issue names, names of people, email addresses, account IDs or JQL; every value passes a filter before it is written.

Data minimization:

• The App reads no assignee, reporter, or user fields. Velocity is computed at team/board level only — never per individual.
• Stored data is limited to numbers, sprint names and dates, the names of statuses and numeric fields, issue IDs and keys, and sprint, board, project, field and status identifiers. Issue titles are read only for the sprint details, as the viewer, and never stored.

5. No External Credentials or Integrations

The App does not require or accept any API keys, tokens, passwords, or third-party credentials. There is no configuration that could expose user secrets, and there are no integrations beyond the Atlassian platform itself. The gadget's user interface is a Forge Custom UI served from the App's own static resources; it contains only inline styles for its own chart and loads no third-party scripts.

6. Dependency & Vulnerability Management

• Runtime dependencies are limited to Atlassian's official Forge packages (@forge/api, @forge/resolver, @forge/kvs, @forge/bridge), maintained and patched by Atlassian.
• Build/test tooling is not included in the production runtime bundle.
• We run npm audit before every Marketplace release and resolve identified vulnerabilities, including dev-only dependencies.
• Security patches are deployed promptly via Forge; the Node.js runtime is maintained by Atlassian.

7. Incident Response

If a security issue is discovered in the App:

• We investigate and begin remediation promptly upon notification or discovery.
• A fix is deployed as a priority update via the Forge deployment pipeline.
• Affected customers are notified via the Marketplace listing and, where possible, directly.

To report a security vulnerability, contact support@janekbehrens.de with the subject line "Security Report — Velocity Chart". We aim to acknowledge reports within 2 business days.

8. Organizational Security Controls

• Access to production: Deployments are performed exclusively by the maintainer (Janek Behrens) via the authenticated Forge CLI.
• Source code: Maintained in a version-controlled repository under the maintainer's control.
• Sub-processors: Atlassian only — it hosts the App on Forge (runtime and storage) under Atlassian's Forge Data Processing Addendum, which includes Standard Contractual Clauses for transfers outside the EEA. All processing occurs within the Atlassian platform.

9. Compliance

• GDPR: The App does not collect or store personal data and does not read user fields. See our Privacy Policy.
• Atlassian security requirements: Built to comply with Atlassian Forge security requirements and the Marketplace security review.
• Runs on Atlassian: Operates under Atlassian's trust boundary, so Atlassian's infrastructure, security controls, and compliance certifications (SOC 2, ISO 27001, etc.) apply to the underlying platform.

10. What We Cannot Access

For complete transparency, we have no technical means to access:

• Any data in your Jira instance (issues, comments, attachments, user data)
• The cached data in Forge Storage within your instance
• Your Atlassian account credentials or session tokens
• Any personal data of your team members