Security Policy

This page describes the security practices behind the Atlassian Forge app Customer Assets for the JSM Portal. For how the App handles personal data, see the separate privacy policy.

Architecture and hosting

• The App is built on Atlassian Forge and runs exclusively on Atlassian-managed infrastructure. BasicData operates no servers of its own.
• The manifest declares no external egress (external.fetch: []). No data can leave your Atlassian site through the App. The App is eligible for Atlassian's "Runs on Atlassian" program.
• All App storage uses Forge hosted storage (Key-Value Store) inside your site's data residency boundary. Data at rest is encrypted by Atlassian.

Access control

• Default deny: every customer query is scope-bound server-side to the signed-in user via the configured owner attribute. Without a verified account ID the result set is empty, even against a manipulated frontend.
• Asset updates are re-authorized server-side before any write.
• Admin endpoints verify Jira administrator permissions as the calling user (via the Jira permissions API, not trusting the client).
• The App requests the minimum Forge scopes needed for its functionality.

Data handling

• Asset data is processed in-memory per request and is not persisted by the App.
• The App collects no passwords, API tokens or third-party credentials from anyone.
• Logs contain no personal data: account identifiers are replaced by one-way hashes before logging. Usage counters are anonymous.

Secure development

• All resolver inputs are validated server-side; AQL queries are built from typed parameters with the customer scope injected server-side.
• Development follows the OWASP Top 10. The frontend is React, which escapes output by default.
• Third-party dependencies are checked for known vulnerabilities with automated scans (npm audit) and kept up to date.
• Development happens on full-disk-encrypted workstations; all development accounts (Atlassian, source control) require multi-factor authentication.

Vulnerability management and incident response

• We follow Atlassian's Marketplace security bug fix policy, including its timelines for fixing reported vulnerabilities by severity.
• In case of a security incident or a critical vulnerability we notify affected customers and Atlassian, following Atlassian's incident notification guidelines.
• Security reports are handled with priority. We respond within one business day.

Reporting a vulnerability

If you believe you have found a security issue in the App, raise a ticket in our support portal (preferred), contact us at support@basicdata.net, or use the contact form. Please include steps to reproduce and do not share the issue publicly before we have addressed it.