Privacy and Security Policy for Healthchecks for Jira: Data Collection, Security Measures, and Compliance

Last updated: March 3, 2026

1. Introduction

Healthchecks: Automatic Clean-up & Configuration Maintenance ("we", "our", or "the App") is an Atlassian Forge application designed to help Jira administrators monitor instance health, identify unused resources, optimize configurations, and manage cleanup operations.

This policy outlines the privacy practices, data collection, and security measures guiding the development and operation of the App. We are committed to ensuring the Confidentiality, Integrity, and Availability (CIA) of your data while giving you full control over it.

2. Scope

This policy applies to the App's functionality and the code maintained by the developer. The App is built on the Atlassian Forge platform and relies significantly on the underlying security controls provided by Atlassian.

3. Data Collection

To provide health monitoring and cleanup functionality, the App collects and processes the following information:

• User Activity Data: We collect and store user-related activity information including:

  • Atlassian Account IDs (accountId), display names, and avatar URLs

  • Activity timestamps (issue creation, updates, comments, worklogs)

  • Last active dates for inactive user analysis

  • Filter ownership and sharing permissions

• Project Activity Data:

  • Project metadata (ID, key, name, lead, category)

  • Issue activity statistics (created, updated, commented events)

  • Component and version management data

  • Attachment and worklog activity

• Custom Field Usage Data:

  • Field definitions and configurations

  • Field usage statistics across issues

  • Duplicate field detection data

  • Field context configurations

• Filter Activity Data:

  • Filter metadata (ID, name, owner, JQL)

  • Sharing permissions and visibility settings

  • JQL validation status (broken/valid)

  • Usage frequency and last active timestamps

• Add-on Usage Data:

  • Installed add-on identifiers

  • Add-on usage patterns (workflow post-functions, custom fields)

  • Add-on activity detection data

• System Configuration Data:

  • Instance-wide statistics (total projects, users, custom fields, etc.)

  • Configuration comparisons over time

  • Healthcheck results and scores

• Issue Changelog Data:

  • Issue event history (create, update, comment, attachment events)

  • Timestamp data for activity heatmaps

  • Field change history for audit purposes

• User Preferences:

  • Per-user in-app preferences and settings

4. Security Architecture and Data Storage

4.1 Host Environment

The App runs entirely within the Atlassian Cloud environment using the Forge platform. We do not operate any external servers, databases, or infrastructure.

4.2 Data Storage

All application data is stored securely using Atlassian Forge storage mechanisms:

• Forge Storage API (Forge KVS): Key-value storage for configuration settings, healthcheck results, and cached activity data.

• Forge SQL: MySQL-based storage module provisioned in the app manifest for structured data as features evolve.

Storage characteristics:

• Encryption: Data is encrypted at rest and in transit by the Atlassian platform.

• Isolation: Data is scoped to the specific Jira instance, preventing unauthorized cross-tenant access.

• Retention: Activity data is retained to enable historical comparisons and trend analysis.

Refer to the Atlassian cloud's data encryption policies for more details.

4.3 Data Transmission

• Internal Traffic: All data transmission occurs within the Atlassian Cloud internal network or securely between the user's browser and Atlassian's servers via TLS 1.2+.

• No Egress: The App does not transmit data to any third-party services or external endpoints.

5. Security Controls

5.1 Authentication and Authorization

• Identity: The App relies on Atlassian's native authentication mechanisms. It does not manage its own user credentials.

• Access Control: The App respects Jira's permission model. Only Jira administrators can access the HealthCheck functionality.

• User Context: All operations are performed in the context of the authenticated user's Atlassian Account ID.

5.2 Application Security

• Input Validation: All user inputs are validated and sanitized to prevent injection attacks (e.g., XSS, script injection).

• Dependency Management: We regularly review and update the App's libraries and dependencies to patch known vulnerabilities.

• Least Privilege: The App operates with the principle of least privilege, requesting only those permissions strictly required for its functionality.

• Long-Running Task Isolation: Background analysis tasks are processed via Forge event queues with proper timeout handling.

• Code Quality: Automated linting and testing enforced via ESLint and Jest to maintain code quality standards.

5.3 Automated Security Controls

The App implements continuous security monitoring through automated CI/CD pipelines:

• Pre-Deployment Security Scanning: Every code change undergoes automated security scanning via npm audit for dependencies before deployment.

• Pre-Commit Hooks: Git hooks automatically lint and validate code before each commit to prevent security issues from entering the codebase.

• Manifest Validation: The Forge manifest is validated using forge lint on every code change to prevent configuration errors and permission misconfigurations.

6. Permissions

The App requests the following scopes to function:

• storage:app: Store healthcheck results, activity data, configuration settings, and historical comparisons in Forge Storage and SQL.

• read:jira-work: Read issues, projects, filters, components, versions, attachments, and worklogs to analyze activity and identify optimization opportunities.

• read:jira-user: Retrieve user information (display name, avatar, account status) for activity tracking and inactive user identification.

• manage:jira-project: Perform remediation actions such as archiving inactive projects or updating project configurations.

• manage:jira-configuration: Access and analyze Jira configuration data (custom fields, workflows, screens) for healthcheck analysis.

• write:jira-work: Write issue properties and perform cleanup actions as part of the remediation system.

6.1 Permission Justification

• Activity Monitoring: Reading issue, project, and user data is essential to calculate activity metrics, identify inactive resources, and generate healthcheck reports.

• Remediation Actions: Write permissions enable administrators to fix identified issues directly from the HealthCheck interface (e.g., archive projects, update configurations).

• User Information: User details are needed to identify inactive users and display ownership information for filters and projects.

• Access Inheritance: If a user loses Jira administrator access, they will not be able to access HealthCheck functionality.

7. Data Usage, Sharing, and Retention

7.1 Data Usage

We use collected data solely for:

• Health Monitoring: Analyzing instance health across projects, users, custom fields, filters, and add-ons.

• Activity Tracking: Generating activity heatmaps and project activity statistics.

• Cleanup Recommendations: Identifying inactive users, unused custom fields, broken filters, and dormant projects.

• Historical Comparisons: Comparing system information over time to track growth and changes.

• Remediation: Enabling administrators to fix identified issues directly from the interface.

• Export Functionality: Generating Excel and CSV exports of activity data and changelog reports.

7.2 Data Sharing

• No Third-Party Sharing: We do not sell, trade, or transfer data to outside parties.

• No Analytics: The App does not contain third-party analytics or tracking scripts.

• No External API Calls: The App does not make external API calls outside the Atlassian ecosystem.

• In-App Only: All data remains within your Jira instance and is only accessible to Jira administrators.

7.3 Data Retention and Deletion

• Automated Collection: Activity data is collected via scheduled triggers and event listeners for real-time monitoring.

• Historical Storage: Activity data is retained to enable week-over-week comparisons and trend analysis.

• Uninstallation: Upon uninstallation, data remains in Atlassian's Forge Storage associated with your instance until purged per Atlassian's data retention policies.

• Export Before Deletion: Users can export issue changelog data (Excel, CSV) before uninstallation for archival purposes.

8. Data Export and Portability

The App provides export capabilities to ensure data portability:

• CSV/Excel Export: Export issue changelog for spreadsheet analysis.

• Filtered Exports: Apply project, user, and date filters before exporting.

Users retain full ownership of this data and can export it at any time.

9. Vulnerability Reporting

We value the contributions of the security community. If you discover a security vulnerability in the App, please report it to us immediately.

• Reporting Channel: Please submit vulnerability reports via the support contact listed on our Atlassian Marketplace listing or through the Idalko Support Portal.

• Response Time: We aim to acknowledge reports within 48 hours.

• Priority Handling: Critical security issues are prioritized and patched as emergency hotfixes.

• Disclosure Policy: We follow responsible disclosure practices and will coordinate with reporters on public disclosure timing.

Support portal: https://services.jira.idalko.com/servicedesk/customer/portal/38

10. Compliance and Standards

10.1 Platform Compliance

The App is built on Atlassian Forge, which provides:

• ISO 27001 and SOC 2 compliance through Atlassian's infrastructure

• GDPR compliance mechanisms via Atlassian's data processing agreements

• Data residency options based on Atlassian Cloud deployment regions

10.2 Data Subject Rights

Under GDPR and similar regulations, users have the right to:

• Access: View all activity data collected about their Jira instance

• Rectification: Configuration settings can be modified at any time

• Erasure: Uninstall the app to stop data collection; contact support for data deletion requests

• Portability: Export activity data in portable formats (CSV, Excel)

• Restriction: Only Jira administrators can access the App's functionality

10.3 Security Development Lifecycle

Our development process includes:

• Secure Coding Standards: Following OWASP guidelines and Atlassian Forge security best practices

• Code Review: All changes require review before merging

• Automated Testing: Unit tests and linting on every commit

• Security Scanning: Automated vulnerability detection in CI/CD pipeline

• Regular Updates: Dependency updates and security patches

11. Incident Response

In the event of a security incident:

1. Detection: Automated monitoring and user reports

2. Assessment: Evaluate severity and impact within 24 hours

3. Containment: Deploy hotfixes to address critical vulnerabilities

4. Notification: Inform affected users via Marketplace listing updates

5. Remediation: Implement fixes and conduct post-incident review

6. Transparency: Document incidents and resolutions in public changelog (when appropriate)

12. Contact and Updates

• Updates: We may update this policy occasionally to reflect changes in functionality, legal requirements, or security practices. The "Last updated" date at the top of this document will reflect the latest revision.

• Notification: Material changes to this policy will be communicated via:

  • Atlassian Marketplace listing updates

  • In-app notifications (if applicable)

• Contact: For questions about this policy, please contact us through:

  • Idalko Support Portal: https://services.jira.idalko.com/servicedesk/customer/portal/38

  • Support channels on the Atlassian Marketplace listing

13. Third-Party Services

The App does not use any third-party services for:

• Analytics or tracking

• External data storage

• API integrations outside Atlassian

• Payment processing (handled by Atlassian Marketplace)

All functionality operates entirely within the Atlassian Forge platform.

14. Children's Privacy

The App is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. The App is designed for business use within organizational Jira instances.

15. International Data Transfers

Data storage and processing occur within Atlassian's cloud infrastructure. Data residency is determined by your Atlassian Cloud instance location and is governed by Atlassian's data processing agreements.

16. Changelog

Healthchecks: Automatic Clean-up & Configuration Maintenance is developed and maintained by Idalko.