SealstepSecurity & data
Built to keep your data inside Atlassian
Answers for the security questionnaire your team will send us.
| Platform | Atlassian Forge. Code runs on Atlassian’s infrastructure. There are no servers of ours. |
|---|---|
| Data egress | None. The manifest declares no external fetch, image, script or style hosts. There are no analytics or telemetry. |
| Runs on Atlassian | Designed to meet the program’s requirements. Eligibility is confirmed by Atlassian’s forge eligibility check at deployment and shown on the Marketplace listing once granted. Not yet granted. |
| Where data lives | Forge key-value storage, which follows the site’s Atlassian data residency, plus one issue property (sealstep-checklist) holding a summary for JQL. |
| What is stored | Checklist items (text, status, required flag, Atlassian account IDs of assignees, due dates, details), templates, settings, and history events (account ID of the actor, timestamp, change summary, hashes). |
| Personal data | Atlassian account IDs only. Names are shown by asking Jira at view time and are not stored. |
| Jira scopes | read:jira-work, write:jira-work, read:jira-user, storage:app. |
| Permissions | Every read and write checks the viewer’s Jira permissions on the issue (browse/edit/transition/admin). Admin features need Jira administrator. |
| Content safety | Markdown-lite rendering never outputs HTML. Only http(s) links are allowed. CSV exports guard against formula injection. |
| Deletion | Uninstalling the app removes its Forge storage under Atlassian’s platform rules. Export first if you need a copy. |
| Open-source components | React, Atlassian Pragmatic drag and drop, and Forge SDK packages, bundled with the app. Nothing is loaded from CDNs. |
This page describes how the software is designed. It is not a contractual commitment or legal advice. See the privacy policy.