Security

Summary

The app is built so that there is as little to attack as possible. It is an Atlassian Forge app that consists only of a page shown inside Jira. It has no server of its own, stores nothing, and makes no network requests outside Atlassian. Jira data is read in the user's browser with that user's own Jira permissions and never reaches GRAMSHIFT.

Architecture

Data handling

• The app reads the issues returned by the JQL search the user enters, with their fields, comments and the attachment list (names, sizes, authors and dates — not attachment contents).
• The data is held in browser memory only while the page is open. The PDF or Excel file is generated in the same browser and handed to the browser as a download.
• Nothing is sent to GRAMSHIFT or to any third party, and nothing is stored by the app. There is therefore no customer data at rest on our side and nothing to delete when the app is uninstalled.
• Internal (Jira Service Management) comments and comments with restricted visibility are left out of exports unless the user chooses to include them.

Access control

• The app requests one Jira permission only: read:jira-work. It cannot create, change or delete anything in Jira.
• Every Jira request is made from the page with the signed-in user's own permissions. The app never acts with app-level permissions, so it can only see what that user can already see in Jira.
• The app does not ask for, collect or store passwords, API tokens or any other credentials.

Encryption

• In transit: the only network traffic is between the user's browser and Atlassian, over HTTPS (TLS), provided by Atlassian.
• At rest: the app stores no data, so there is no app data to encrypt at rest. Jira data stays in your Atlassian site under Atlassian's own protection.

Secure development

• Search input is passed to the Jira REST API as an encoded query parameter; Jira parses and validates the JQL under the user's permissions.
• Text from Jira is written to the page as plain text, never as HTML, so issue content cannot inject scripts into the app.
• Excel cells are written as plain values, never as formulas, to prevent formula injection when the file is opened.
• The app contains no secrets (no API keys or tokens).
• Releases are tested end to end on our own Jira Cloud test site, including a check that the app page makes no network requests outside Atlassian.

Vulnerability management

• Third-party libraries are scanned for known vulnerabilities with npm audit, and fixes are released as new app versions.
• We follow the Atlassian Marketplace Security Bug Fix Policy for cloud apps: critical issues are fixed within 10 days, high within 4 weeks, medium within 12 weeks and low within 25 weeks.
• To report a vulnerability, email contact@gramshift.com. We aim to reply within 3 business days (Monday to Friday, Japan time). Please do not include customer data in the report.

Security incidents

If we become aware of a security incident affecting the app, we notify Atlassian within 24 hours through the Marketplace partner security incident process, and we inform affected customers where their data is involved, following Atlassian's security incident guidelines for Marketplace partners.

Certifications and programs

GRAMSHIFT is a small business and does not hold security certifications such as SOC 2 or ISO 27001, and the app is not currently part of the Marketplace Security Bug Bounty Program. The app runs entirely on Atlassian's Forge platform; see Atlassian's own trust and compliance documentation for the platform.

Related documents

Privacy Policy · How to use the app

Contact

GRAMSHIFT · contact@gramshift.com · 1-10-8 Dogenzaka, Shibuya Dogenzaka Tokyu Bldg 2F-C, Shibuya-ku, Tokyo 150-0043, Japan

日本語（要約）

本アプリは Atlassian Forge 上で動く、Jira の中の1画面だけのアプリです。自社のサーバー・保存領域・外部への通信を持ちません。課題データは、使っている人のブラウザの中で、その人自身の Jira の権限で読み取り、GRAMSHIFT にも第三者にも送られません。要求する権限は read:jira-work（読み取り）だけです。通信は利用者のブラウザと Atlassian の間の HTTPS だけで、アプリはデータを保存しません。利用している部品は npm audit で確認し、脆弱性は Atlassian Marketplace の修正期限（重大は10日以内など）に従って直します。脆弱性の報告は contact@gramshift.com へ。SOC 2・ISO 27001 などの認証は取得していません。