Fields Usage for Jira Security Policy

---

The app is read-only, never modifies Jira configuration or issue data, runs entirely on Atlassian Forge infrastructure, and does not store, transmit, or retain customer data.

The app runs entirely inside Atlassian's Forge secure sandbox, which isolates, authenticates, and manages all execution.

All data access is controlled through Atlassian-approved OAuth scopes explicitly declared in the app manifest.

The app only reads Jira configuration data required to provide its functionality and only accesses data that the current user is authorized to view.

This includes information related to:

• Custom Fields
• System Fields
• Projects
• Screens
• Screen Tabs
• Screen Schemes
• Issue Type Screen Schemes
• Field Configurations
• Field Configuration Schemes
• Workflows
• Workflow Schemes
• Workflow Transitions
• Field-to-Project Relationships
• Field-to-Screen Relationships
• Field-to-Workflow Relationships
• Related Jira Configuration Metadata

The app respects Jira permissions and users can only view data they already have permission to access. The app is designed to provide visibility into field usage, field relationships, configuration dependencies, and field impact across Jira projects and configurations.

The app performs no writes and does not modify fields, projects, screens, workflows, configurations, or any other Jira content.

The app does not connect to any external servers, APIs, databases, analytics services, or third-party services.

All processing occurs within Atlassian-managed infrastructure.

No customer content is intentionally logged or transmitted.

Logs are limited to operational and diagnostic information required for application support and troubleshooting within the Atlassian Forge platform.

Security of authentication, authorization, storage, networking, and data isolation is provided by the Atlassian Forge platform.

Because the app runs entirely within Atlassian infrastructure and does not use external services or external data storage, it relies on the security controls provided by Atlassian, including, but not limited to, controls supporting compliance programs such as SOC 2, ISO 27001, GDPR-related safeguards, and other applicable security and compliance controls.

If you have questions regarding this Security Policy, please contact Simitech Ltd through the support channels listed on the Atlassian Marketplace.