Data security and privacy
This page describes what External Share & Public Links for Jira stores and processes, where, and how it's protected. Use it for your security review, together with the privacy and security tab of the Marketplace listing.
Where the app runs
The app is built on Atlassian Forge. Its code, its storage and the shared pages all run on Atlassian's infrastructure. The app's server side has no permission to send data to any address outside Atlassian, and the app has no servers of its own.
The app isn't marked "Runs on Atlassian", because shared pages are served through a public Forge web trigger. See Why this app is not "Runs on Atlassian".
What the app stores
Everything below is kept in Forge hosted storage, inside your site's app installation.
| Data | What it holds | Why |
|---|---|---|
| Link settings | The link's sections, fields, columns, board options, theme, accent color, comment and embedding switches, expiry date, label and a salted hash of its password | To serve the link the way its creator set it up |
| Link names | The key and summary of the shared work item, the board name, or the saved filter name, as they were when the link was last saved | To list links by name in My share links and on the admin page |
| Who made a link | The Atlassian account IDs of the person who created the link and the person who changed it last, with the dates | To decide who can change the link, and to show it in the lists |
| Link activity | Each link's number of opens, its first and last open, opens per day for 30 days, its last 20 open times, wrong passwords in the last 7 days, and opens after it expired | To show link activity. Deleted with the link |
| App settings | The sharing policy, including group IDs and space keys | To apply the policy |
| Audit log | The newest 100 events: what happened, to which link, the account ID of who did it, and when | So Jira admins can review sharing |
| Comment counters | How many viewer comments each link took this hour and today | To limit viewer comments |
| Field list | The names and IDs of your site's Jira fields, refreshed every 24 hours | To offer fields quickly in the share window |
The app never stores:
- Work item content: descriptions, comments, attachments, work logs and fields. The app reads them from Jira each time a shared page loads and doesn't keep a copy.
- Anything about the people who open a link: no names, email addresses, IP addresses, devices or cookies.
- Passwords in readable form. The app keeps only a salted PBKDF2 hash, so nobody can read a password back.
Viewer comments are posted to the work item in Jira, with the name and email the viewer chose to give. They're stored in Jira like any other comment, not in the app. See Let viewers comment.
How data flows
- A viewer opens a link. The request goes to the app's web trigger on Atlassian Forge.
- The app checks the link's token, the app license, the expiry date and, if set, the password. A wrong token or a turned-off link gets This link isn't active, and nothing is read from Jira.
- The app reads only what the link shows from Jira's REST API, with the app's own access. Spaces your Jira admin doesn't allow to be shared are always left out.
- Before anything leaves the server, the app removes what the link doesn't show: switched-off sections and fields, internal comments, and comments and work log entries restricted to a role or group.
- The viewer's browser shows the page. The page is sent with a header that stops browsers from caching it, and every visit reads Jira afresh.
- No data goes to Apportunity or to any third party.
The viewer's browser keeps two small items of its own: the name and email the viewer typed into the comment form, for next time, and a marker that the tab's open was already counted. Neither leaves the browser.
Data residency
Forge hosted storage keeps the app's data in the same location as your Jira site, and moves it with the site when an admin changes the site's data residency location. See Atlassian's Forge data residency page for the supported locations.
Encryption, retention and deletion
- In transit: all traffic between browsers, Forge and Jira uses HTTPS.
- At rest: Forge hosted storage is encrypted on disk by Atlassian.
- Turning off a link deletes its settings and its activity at once.
- Uninstalling the app: Atlassian keeps the app's stored data for 28 days, so it can be restored if you reinstall, then deletes it. To restore data after reinstalling, contact support within 21 days of uninstalling.
App permissions
The app asks for these Jira permissions (scopes) when it's installed:
| Scope | What the app uses it for |
|---|---|
read:jira-work | Read the work items, comments, attachments, work logs and saved filters that a link shows |
read:jira-user | Show the names and avatars of assignees, reporters and commenters |
write:jira-work | Post comments from viewers, when a link allows it |
read:board-scope:jira-software, read:issue-details:jira | Read a board's cards and backlog |
read:board-scope.admin:jira-software, read:project:jira | Read a board's columns, WIP limits and sub-filter |
read:jql:jira | Read a board's quick filters |
read:sprint:jira-software | Read a board's active and future sprints |
storage:app | Keep the app's own data in Forge hosted storage |
Subprocessors and AI
The app uses no subprocessors other than Atlassian, and it has no AI features.
Report a security issue
Report a vulnerability or ask a security question through the support portal.
Related
- Sharing policy settings: who can share, and which spaces can be shared.
- Review and turn off links across the site: the admin tables and the audit log.
- Native Jira anonymous access: why sharing whole spaces publicly is riskier.