Security and data
The short version for a security review. The privacy policy has the full list of what each app stores.
Where the apps run
All three apps are built on Atlassian Forge. Their code runs on Atlassian's infrastructure and calls only Atlassian APIs. Altoria runs no servers of its own for the apps, and the data they store stays in Forge storage. Altoria sees three things: the error logs Atlassian shares with app developers, which can contain identifiers such as issue keys; the site name and licence status the Marketplace gives partners for billing; and any support email you send. The only request to altoria.app is Jira loading the app icons. The privacy policy has the detail.
What each app can do
- Doorman
- Read scopes, app storage, the personal data reporting scope, and manage:jira-configuration, which Jira requires before an app may read application roles, global settings and the audit log. It uses that scope only to read. Only Jira administrators can open it.
- Super SLA
- Read scopes, app storage, the personal data reporting scope, and read and write app data scopes. It adds five SLA fields of its own to service project issues and keeps their values up to date. It does not create or edit SLA goals, calendars or anything else in Jira.
- Precheck
- Read scopes only. No storage. Every call runs as the person using it, so it sees only what their Assets permissions allow. Import files are read in the browser.
Where data is stored and for how long
Doorman and Super SLA keep their data in Forge hosted storage in the same region as your Jira site. After an app is uninstalled, Atlassian keeps its storage for 28 days and then deletes it. Each week the apps ask Atlassian which accounts were closed and remove their names. Precheck keeps nothing once the page closes.
Certifications
Doorman and Super SLA keep their data in Forge hosted storage; Super SLA also writes its own SLA fields on your Jira issues. Atlassian states that the Forge platform is SOC 2 attested and ISO 27001 certified.
Report a vulnerability
Email support@altoria.app with "Security" in the subject. The contact is also in security.txt.