Security

Summary

The app is built so that there is as little to attack as possible. It is an Atlassian Forge app made of pages shown inside Jira and validators that Jira evaluates. It has no server of its own, keeps no data outside your Jira site, and has no permission to contact anything outside Atlassian. Checklists are read and written with the signed-in user's own Jira permissions and never reach GRAMSHIFT.

Architecture

Data handling

• The app reads and writes the checklist of the open issue and the templates of its project, and reads the checklist of the original when the issue is a clone. It also reads the links of the issue, whether the user may edit it, the work types of the project, and the names of people who are or can be assigned to items.
• Names, permissions and work types are held in browser memory only while the page is open.
• Nothing is sent to GRAMSHIFT or to any third party; there is no customer data at rest on our side.
• Assistants that customers connect to the Atlassian Rovo MCP server work through Atlassian with the permissions of the connected account, and do not pass through GRAMSHIFT.

Access control

• The app requests four Jira permissions: read:jira-work, write:jira-work, read:jira-user and manage:jira-project. It writes only its own issue property and its own project property.
• Every Jira request is made from the page with the signed-in user's own permissions. The app never acts with app-level permissions. Jira accepts a checklist change only from someone who may edit the issue, and a template change only from someone who may administer the project.
• People who may only view an issue get a read-only list, and an inactive license makes the panel read-only.
• The app does not ask for, collect or store passwords, API tokens or any other credentials.

Encryption

• In transit: all of the app's own network traffic is between the user's browser and Atlassian, over HTTPS (TLS), provided by Atlassian.
• At rest: the app stores nothing on our side. Checklists and templates stay in your Atlassian site under Atlassian's own protection.

Secure development

• Checklist text, from people or from AI assistants, is written to the page as plain text, never as HTML, so it cannot inject scripts into the app.
• Data read from Jira is checked before use: an unreadable or oversized saved value is shown as a message or reduced to a safe form, and it is never run.
• Assignee names come from Jira by account ID, so a saved value cannot make someone appear under another person's name.
• The app contains no secrets (no API keys or tokens).
• Releases are tested end to end on our own Jira Cloud test site, including a check that the app page reports no content security policy violations or page errors.

Vulnerability management

• Third-party libraries are scanned for known vulnerabilities with npm audit, and fixes are released as new app versions.
• We follow the Atlassian Marketplace Security Bug Fix Policy for cloud apps: critical issues are fixed within 10 days, high within 4 weeks, medium within 12 weeks and low within 25 weeks.
• To report a vulnerability, email contact@gramshift.com. We aim to reply within 72 hours (Monday to Friday, 9:00–18:00 Japan time). Please do not include customer data in the report.

Security incidents

If we become aware of a security incident affecting the app, we notify Atlassian within 24 hours through the Marketplace partner security incident process, and we inform affected customers where their data is involved, following Atlassian's security incident guidelines for Marketplace partners.

Certifications and programs

GRAMSHIFT is a small business and does not hold security certifications such as SOC 2 or ISO 27001, and the app is not currently part of the Marketplace Security Bug Bounty Program. The app runs entirely on Atlassian's Forge platform; see Atlassian's own trust and compliance documentation for the platform.

Related documents

Privacy Policy · How to use the app

Contact

GRAMSHIFT · contact@gramshift.com · 1-10-8 Dogenzaka, Shibuya Dogenzaka Tokyu Bldg 2F-C, Shibuya-ku, Tokyo 150-0043, Japan

日本語（要約）

本アプリは Atlassian Forge 上で動く、Jira の中の画面と、Jira が評価する検証だけのアプリです。自社のサーバー・アプリ独自の保存領域・外部への通信を持ちません。チェックリストとテンプレートはお客様の Jira サイトの中（課題とプロジェクトのプロパティ）に保存し、その人自身の Jira の権限で読み書きするため、GRAMSHIFT にも第三者にも送られません。要求する権限は read:jira-work・write:jira-work・read:jira-user・manage:jira-project の4つで、書き込むのはこのアプリのプロパティだけです。チェックリストの文字は人が書いた物も AI が書いた物も文字としてだけ画面に出し、動かすことはありません。アプリ自身の通信は利用者のブラウザと Atlassian の間の HTTPS だけです。利用している部品は npm audit で確認し、脆弱性は Atlassian Marketplace の修正期限（重大は10日以内など）に従って直します。脆弱性の報告は contact@gramshift.com へ。SOC 2・ISO 27001 などの認証は取得していません。