Assets History&Snapshots Reporter for Jira Security Policy

---

The app is read-only, never modifies Jira configuration or issue data, runs entirely on Atlassian Forge infrastructure, and does not store, transmit, or retain customer data.

The app runs entirely inside Atlassian's Forge secure sandbox, which isolates, authenticates, and manages all execution.

All data access is controlled through Atlassian-approved OAuth scopes explicitly declared in the app manifest.

The app only reads Jira and Jira Assets data required to provide its functionality and only accesses data that the current user is authorized to view.

The app performs no writes and does not modify any Jira or Jira Assets content.

The app does not connect to any external servers, APIs, databases, analytics services, or third-party services.

All processing occurs within Atlassian-managed infrastructure.

No customer content is intentionally logged or transmitted.

Logs are limited to operational and diagnostic information required for application support and troubleshooting within the Atlassian Forge platform.

Security of authentication, authorization, storage, networking, and data isolation is provided by the Atlassian Forge platform.

Because the app runs entirely within Atlassian infrastructure and does not use external services or external data storage, it relies on the security controls provided by Atlassian, including, but not limited to, controls supporting compliance programs such as SOC 2, ISO 27001, GDPR-related safeguards, and other applicable security and compliance controls.

If you have questions regarding this Security Policy, please contact Simitech Ltd through the support channels listed on the Atlassian Marketplace.