Security

Where Keelbits apps run, what they store, who can reach it, what we do when something goes wrong, and what we can and cannot see.

Last updated 2026-09-18 · Security contact: security@keelbits.com · security.txt

Runs on Atlassian Forge. The app runs on Atlassian's infrastructure. Keelbits operates no servers for it.
No external egress. The app manifest declares no external network permissions. Data does not leave Atlassian.
Storage in your installation. Copies live in Forge SQL and key-value storage that belong to your site's installation.
Administrators only. Every operation checks the caller's Jira administrator permission before the app acts.

Architecture

Keelbits apps are Atlassian Forge apps. Their functions run on Atlassian infrastructure and their data sits in Forge storage tied to your installation; each installation has its own schema. There is no Keelbits backend, no external database and no outbound network access: the manifest declares no egress permissions, which is what the Runs on Atlassian programme requires.

Keelbits cannot read, export or modify the data in your installation. When you ask for support we may ask you for screenshots or exports, because we have no other way to see it.

What Issue Recycle Bin stores

The app keeps a continuous mirror of your issues so that a deleted one can be restored in full.

Data	What is kept
Issue fields	The full field set as Jira returns it for the issue, updated on every change
Comments	Body, author account id, created and updated dates
Work logs	Time spent, start date, author account id, work log comment
Issue links	Link type and the ids of both issues
Attachments	File name, size, type, author, date. Never the file itself
Sub-tasks	Parent relationship, as ordinary issues
Deletions	Who deleted an issue and when, resolved to a display name
Settings and progress	Retention period; progress of the initial load; date and result of the last personal data report

Inside these copies are account ids and display names: the assignee, reporter and creator of each issue, the authors of comments, work logs and attachments, and the user who deleted an issue. Application logs record operations and error codes, never issue content or names.

Permissions the app requests

Forge asks you to grant these scopes at install time. The app requests nothing else.

Scope	Why
`read:jira-work`	Read issues, comments, work logs, links and attachment metadata for the mirror
`read:jira-user`	Resolve the display name of the user who deleted an issue and refresh names that Atlassian reports as changed
`report:personal-data`	Report the stored account ids to Atlassian every 7 days (personal data reporting, see below)
`write:jira-work`	Create the restored issue, its comments, work logs and links
`storage:app`	Use Forge key-value storage for settings and initial-load progress

Who can access the data

The app page lives under Jira settings → Apps and is shown to Jira site administrators. Every operation, including listing the trash and restoring, checks the caller's administrator permission on the server before the app acts with its own identity. There is no user-level or project-level view.

Retention and deletion

Deleted issues are kept for 30, 90, 180 or 365 days, 90 by default, and removed by a daily cleanup (retention).
An administrator can empty the trash at any time.
After a successful restore the app deletes its copy of that issue.
Every 7 days the app reports the account ids it stores to Atlassian through the Forge personal data reporting API. Closed accounts are erased from every copy (account id and name); renamed accounts get the new name. An administrator can run the report at any time from the Settings tab.
Uninstalling the app removes its Forge storage; a reinstall starts with an empty mirror. We verified this on our development site.

Subprocessors

Atlassian, as the operator of Forge and of your Atlassian site, is the only party that processes app data. The providers below serve this website and support email; neither sees app data.

Provider	Role	Location	Sees app data
Atlassian (Atlassian Pty Ltd and affiliates)	Hosting of the app and its Forge storage under the Forge Data Processing Addendum	Region of your Atlassian site	Yes, as host
Hetzner Online GmbH	Virtual server for this website	Germany	No
Cloudflare, Inc.	DNS and email forwarding for keelbits.com	Global network	No

We announce a new subprocessor for app data by email to the technical contact at least 30 days in advance (Data Processing Agreement §6).

Certifications and questionnaires

Keelbits holds no SOC 2 or ISO 27001 certification and has not completed a CAIQ questionnaire. We are a small vendor and rely on Atlassian's platform controls for hosting and storage; Atlassian publishes its own certifications at atlassian.com/trust. We answer security questionnaires and sign the Data Processing Agreement by email; expect a reply within 7 days.

Incident response

If we learn of a security incident that affects your data, we:

Contain it: fix or disable the affected function and release the fix through the Marketplace.
Report it to Atlassian through the Marketplace security incident process, as its security requirements demand.
Notify the technical contact of every affected installation without undue delay and no later than 72 hours after we become aware, with what happened, what data and people are affected, the likely consequences and what we did.
Publish a short post-incident note on this page.

Because the app has no egress and we hold no copy of your data, an incident on our side can only come from a defect in the app's code or from the Atlassian platform, which has its own incident process.

Reporting a vulnerability

Write to security@keelbits.com with "Security" in the subject and the steps to reproduce; encrypted mail is not required. The same contact is published in /.well-known/security.txt. We acknowledge within 7 days, keep you informed until the issue is fixed and credit you if you wish. Please give us time to fix the issue before publishing it, and do not test against installations you do not own. There is no bug bounty programme.