Security policy

Platform and hosting

Appix apps are built on Atlassian Forge and run entirely on Atlassian's cloud infrastructure. Appix does not operate servers, databases or remote backends that receive, store or process data from your Atlassian site.

Hosting, storage, network security, encryption in transit and at rest, and data residency are provided by Atlassian. See the Atlassian Trust Center for details.

Data protection

• App data is stored in Forge storage within the customer's Atlassian environment and follows that site's data residency.
• Our apps only request the Atlassian permissions (scopes) they need, and their manifests limit any outbound connections to declared Atlassian domains.
• Our apps do not collect Atlassian passwords or API tokens. ProjectClone Pro version 4.1.0 and later does not read, log or store email addresses or display names. Excel Exporter reads display names only to show who a template is shared with, never stores them, and never reads email addresses. ProjectClone (Free) requests permission to read user profiles and email addresses; see our Privacy policy for details.
• Secrets an app generates, such as signing keys for paired connections, are kept in Forge secret storage and never appear in URLs, logs or source code.
• Our apps do not use AI or machine-learning services on customer data.

Our Privacy policy describes the data our apps process.

Access control in our apps

• Users sign in with their Atlassian account. Our apps have no separate logins, passwords or sessions.
• Apps respect Jira permissions. Before an app performs an action with its own permissions, it checks the user's permissions through Atlassian's permission APIs.
• Where an app offers an access list, a Jira administrator chooses which users and groups can use it. The app checks this list on every request, and checks it again on long-running actions.
• Paid apps check the site's license on the server, not only in the browser.

Secure development

• Every change is deployed to a development environment, then to staging, and tested there before it reaches production.
• Code is checked with Atlassian's Forge Security Requirements Tester (FSRT) static analyzer before release.
• Third-party dependencies are scanned with npm audit before each release and kept up to date.
• User input is validated on the server. Calls to Atlassian APIs use Forge's route templates, which escape parameters, and the interface escapes all text it displays.
• Each app version also goes through Atlassian's Marketplace security scanning, and its findings are fixed and tracked to resolution.

Logging

Our apps log key technical events, such as actions started, access denied, permission changes and connection changes. ProjectClone Pro version 4.1.0 and later identifies users in logs by Atlassian account ID only and does not log email addresses or display names. Excel Exporter logs identify users by Atlassian account ID and include template and report names. Logs do not contain passwords or API tokens. They are kept in Atlassian's Forge logging service, and only authorized Appix developers can see them.

Vulnerability management

We fix security vulnerabilities within the timeframes set by Atlassian's Marketplace Security Bug Fix Policy, according to their severity. We track vulnerabilities reported by Atlassian through Atlassian's ecosystem security process, and we review reports sent to us directly.

Incident response

If a security incident or critical vulnerability affects one of our apps, we will investigate and contain it. We will notify Atlassian and affected customers following Atlassian's security incident management guidelines.

Report a security issue

If you believe you have found a security vulnerability in an Appix app, email support@appix.ca with SECURITY - <app name> in the subject. Please include:

• the app name and the version installed on your site
• a description of the issue and its potential impact
• steps to reproduce it

Please don't include passwords, API tokens or confidential customer data. Give us reasonable time to fix the issue before sharing it publicly. Appix apps are not currently part of the Marketplace Bug Bounty program.

Certifications

Appix does not currently hold independent certifications such as SOC 2 or ISO 27001. Atlassian's certifications cover Atlassian's own services within the scope Atlassian describes; they do not certify Marketplace partners or apps. Organizations with regulated data should assess our apps against their own requirements. We are happy to answer security questionnaires at support@appix.ca.