Security
Our apps run on Atlassian Forge and keep your data inside Atlassian. This page says what that means, and what it does not.
Where your data lives
- Our apps run on Atlassian-hosted compute and store data only in your Jira site, as Jira issue properties and user properties. They keep no data in storage of their own. We operate no servers, databases or third-party services that receive customer data.
- Our apps make no requests to outside hosts. They contain no analytics and set no cookies.
- Data residency and encryption at rest are provided by Atlassian's platform. See the Atlassian Trust Center for how Atlassian protects hosted data.
Access and permissions
- Apps call Jira on behalf of the person using the app, so they only see what that person is allowed to see.
- Each requested Atlassian permission scope is explained in the app's documentation and on its Marketplace listing.
Our practices
- Apps are built for least privilege and least data: we do not store data we do not need.
- Dependencies are limited to what the app needs.
- Apps go through Atlassian's Marketplace security review before they are listed.
What we do not claim
Quillmark Labs holds no security certifications (for example SOC 2 or ISO 27001). We are a small company, and we rely on Atlassian's platform for the infrastructure controls that those certifications cover.
Report a vulnerability
Email support@quillmarklabs.com with "Security" in the subject. Describe what you found and how to reproduce it. We will reply within 2 business days, tell you whether we can reproduce it, and keep you informed until it is fixed. Please give us a reasonable chance to fix a problem before you disclose it publicly, and do not access data that is not yours.