Security policy

Architecture and hosting#

Cost Tracker is built entirely on Atlassian Forge, in UI Kit (not Custom UI) — its interface is rendered by the platform itself, not by code we serve. It has no servers, databases, or infrastructure of its own: it stores no data outside Atlassian, and its manifest declares no permission to make an outbound network call to anything other than Atlassian's own APIs.

TLS, HSTS, DDoS protection, encryption at rest, physical security, and patching of the underlying platform are Atlassian's responsibility, not ours — and are covered by Atlassian's own SOC 2 Type II and ISO 27001 certifications.

Data we handle#

The app reads issue and worklog data, live, using the viewer's own Jira permissions, scoped to whichever cost project they're looking at — and shows it straight back to them, aggregated into cost, budget and revenue figures. None of it is copied anywhere else.

What's written to Forge's key-value storage is the configuration your users enter directly — project names and scopes, hourly rates, expenses, budgets, report settings — plus a short-lived cache of computed totals. Full detail, including exactly what is and isn't kept, is in the privacy policy.

The app holds no permission to create, edit, transition, or comment on an issue — it cannot write to Jira at all.

Authentication and access control#

There is no independent login system. Every request runs as the signed-in Jira user, authenticated by Forge through their existing Jira session — we never collect, transmit, or store Atlassian usernames, passwords, or API tokens.

Within the app, every project-scoped action is additionally checked against that project's own sharing setting (owner, editor, viewer, or restricted) before it runs, server-side, using the caller's account ID as supplied by Forge rather than anything the client claims. Access is bounded by the scopes declared in the app's manifest:

No write scope is declared anywhere in the manifest.

Internal security practices#

Cost Tracker is developed by a small team at Vudia.

• Multi-factor authentication is enforced on the Atlassian Developer Console account and on the GitHub account (Dbelokon-cpu) that hosts both this documentation site and the app's source.
• Source code is kept in a private GitHub repository — not publicly browsable — with the same MFA-protected account controlling access.
• Dependabot is enabled on that repository: alerts and automated security fixes for known vulnerabilities, plus a weekly check for routine dependency updates.
• Credentials are kept in a password manager; passwords are not shared or reused across services.
• Every change runs through an automated test suite and a linter in CI before it ships.

Vulnerability management#

Development follows OWASP Top 10 guidance — every project-scoped resolver is required to pass through the app's own access check, enforced by a test that fails the build if a new one is added without it. Dependabot watches the dependency tree continuously and opens a pull request when a known vulnerability is published.

We are evaluating enrolment in the Atlassian Marketplace-managed security bug bounty program (via Bugcrowd). In the meantime, reports are handled directly — see contacts below — and we follow the Marketplace's own SLA: 10 days for Critical severity, 28 days for High severity.

Incident response#

1. Investigate the report and confirm scope — what's affected, and how.
2. Notify Atlassian within 24 hours via a priority (P1) support ticket if the platform itself is implicated.
3. Contain the issue and ship a remediation.
4. Notify affected customers directly if any of their data was involved.
5. Run a post-incident review and record what changes as a result.

Business continuity#

Because the app has no infrastructure of its own, its availability depends entirely on Atlassian Forge's own SLA and uptime — there is no independent server, database, or backup process for it to fail separately from Atlassian's platform.

Third-party risk#

Atlassian is the only third party involved: it provides storage, hosting, and operations, and is certified under SOC 2 Type II and ISO 27001. The app uses no analytics, no subprocessors, and no external APIs — its manifest declares no permission to reach anything outside Atlassian.

Compliance#

We do not hold independent security certifications (SOC 2, ISO 27001, or similar) at this time. The app inherits the controls of Atlassian's own certified platform, and is built to comply with the Atlassian Marketplace's security requirements for Cloud apps.

Policy review#

This policy is reviewed at least once a year, and sooner if the app's architecture, data handling, or team changes materially.