Skip to content
Systematic home

Documentation

Collision Guard

Security

Collision Guard is built on Atlassian Forge and runs entirely on Atlassian's infrastructure. This page explains how the app protects your data and how we handle security issues. For what the app stores and why, see Privacy and data.

Where the app runs

  • The app's code runs on Atlassian Forge, inside Atlassian's cloud. Systematic runs no server for it.
  • It is eligible for the Runs on Atlassian program: it has no egress, sends nothing outside your site and uses no third-party services.
  • Data residency follows your Atlassian site: the app's storage lives where Atlassian keeps your site's Forge data.

Data handling

  • The app stores only its settings, active claims (an Atlassian account ID and an expiry time) and daily counts per project. It stores no issue content, field values, comments or customer data.
  • Expired claims are erased every hour, and account IDs are reported weekly through Atlassian's personal data reporting API, so closed accounts are removed.
  • Presence and change alerts travel between browsers over Forge Realtime and are never stored. Change alerts carry field names, never values.

Encryption

  • All traffic between browsers, Jira and the app uses HTTPS (TLS), provided by the Forge platform.
  • Stored app data is encrypted at rest by Atlassian's Forge storage.
  • Each issue's realtime channel is signed by the app, so only people who have that issue open receive its alerts.

Access control

  • The app asks for the fewest Jira permissions it needs: reading issues and users, reading service requests, and its own storage.
  • Every request is made as the person viewing the issue, so the app shows only what that person can already see in Jira.
  • Only Jira administrators can open the admin page and change settings.
  • No one at Systematic has access to your site or your data.

Secure development

  • Every release is reviewed before it ships and deployed through Atlassian's Forge pipeline.
  • Dependencies are kept up to date and checked for known vulnerabilities before each release.
  • The app follows Atlassian's security requirements for cloud apps.

Reporting a vulnerability

If you think you have found a security issue in Collision Guard, write to info@systematic.com.lb with the subject Security. Include the steps to reproduce it and, if you can, your Jira site address.

  • We confirm receipt within one business day.
  • We investigate every report and keep you informed until it is resolved.
  • Critical issues are fixed as a priority and released as soon as a fix is ready.
  • Please do not share the issue publicly until it is fixed.

Security incidents

If a security incident affects your data, we notify affected customers and Atlassian without undue delay and follow Atlassian's incident handling process for Marketplace apps.