This Security Policy outlines the measures that protect your data when you use Tree View for Jira.
2. "Runs on Atlassian" Architecture
The App is built natively on the Atlassian Forge platform and is eligible for the Runs on Atlassian program:
No data egress: the App does not communicate with any external server, CDN or third-party API. Its code is bundled and served by Atlassian.
Isolated runtime: the App runs in Atlassian's isolated, managed Forge environment.
3. Scoped Permissions
The App requests only the Atlassian API scopes it needs:
read:jira-work: to read the work item, its ancestors, children and their fields to build the tree.
write:jira-work: to attach export files (JSON, CSV, SVG, PDF) to the work item when you request an export.
read:jira-user: to read your profile (name, time zone, locale) for date formatting and the export header.
4. Data Protection
Data in transit: all communication with Jira's APIs is encrypted with TLS.
Data at rest: any data the App keeps stays in your Atlassian site, protected by Atlassian's encryption standards.
Your permissions apply: every Jira request runs as the person viewing the tree, so it only ever shows work items that person may see.
Performance limits: trees are capped at 10 levels and 500 work items, so one request can never load an unbounded hierarchy.
5. Vulnerability Management
We welcome the responsible disclosure of security vulnerabilities. If you discover a potential security issue, please report it to us at the email address below.