Security statement
Feature Bundle runs entirely on Atlassian. It has no servers of its own, sends no data outside Atlassian, and stores only the configuration of its features. This page answers the basic security questions. For the security approach of the company, see the Trust Center.
What is the architecture of Feature Bundle?
Feature Bundle is built on Atlassian Forge, Atlassian’s platform for cloud apps. It runs on Atlassian’s infrastructure inside Jira and has no backend of its own. Its interface is built with React.
On the Atlassian Marketplace, Feature Bundle has the Runs on Atlassian badge. See No data egress.
Does the app send data outside Atlassian?
No. Feature Bundle has no servers of its own and doesn’t call services outside Atlassian. See No data egress.
What data does the app process?
- User data: the account ID, the display name, the email address, the language, and the groups of a user.
- Organizations, and the details of customers and organizations.
- Request data: fields, comments, attachments, links, approvals, and SLA information.
- Jira configuration: statuses, roles, workflows, screens, and application properties.
- Information about request types, portals, and spaces.
- Jira Assets objects.
What data does the app store, and where?
Feature Bundle stores the configuration of its features on Atlassian. Request data stays in Jira: when a customer edits a request, the app writes the new values to Jira.
- Additional Fields: the configuration of panels.
- Customer Actions: the configuration of forms, and a counter of saves for the saving limit of each form and request.
- Ticket Journey: the steps, the translations, and the colors.
- Announcement Banners: the settings and the text of banners. When you delete a banner, its data is deleted.
- App Configuration and Global configuration: the arrangement of panels and the global settings.
Configuration is stored in Forge Key-Value Store and Forge Entities Storage. The app also keeps small settings as Jira issue properties, space properties, and app properties. For where the data is located, see Data residency.
Does the app encrypt data and have retention and backup policies?
- Encryption: it follows the data management policies of Atlassian.
- Data residency: Feature Bundle supports data residency through Atlassian. See Data residency.
- Retention: on a written request, Appsvio and Atlassian delete end user personal data, as described in the Forge Data Processing Addendum.
- Backup: it follows the data management policies of Atlassian.
What compliance does Appsvio hold?
- Appsvio has been SOC 2 Type II compliant since October 2023. The report is available in the Trust Center.
- Feature Bundle has the Runs on Atlassian badge. Atlassian gives it to Forge apps that use only Atlassian-hosted compute and storage.
- Feature Bundle takes part in the Marketplace Security Bug Bounty Program of Atlassian, in which outside researchers test the app for vulnerabilities.
Does the app keep logs?
Yes. Feature Bundle writes technical logs, and they are stored on the Forge side. The Appsvio Operations Security Policy defines which data the app logs.
What permissions does the app require?
Feature Bundle declares 17 permissions. See Scopes justification for the list and the reason for each.
Useful links and more information
- Trust Center
- Privacy policy of Appsvio apps
- To ask a question about security, write to security@appsvio.com.