Security

Move Objects for Assets is built on Atlassian Forge and runs entirely on Atlassian's infrastructure. This page explains how the app protects your data and how we handle security issues. For what the app stores and why, see Privacy and data.

Where the app runs

The app's code runs on Atlassian Forge, inside Atlassian's cloud. Systematic runs no server for it.
It is eligible for the Runs on Atlassian program: it has no egress, sends nothing outside your site and uses no third-party services.
Data residency follows your Atlassian site: the app's storage lives where Atlassian keeps your site's Forge data.

Who can move objects

Only the admin page can call the app, and only for a Jira administrator.
Before the app reads or changes anything, it asks Jira and Assets as you whether you are a Jira administrator and which object schemas you manage. A move needs you to manage both schemas.
Old objects are deleted as you, so Assets applies your own rights again.
The move log only shows moves in schemas you manage.

Every change is checked first

The choice made on the page is worked out again on the server; the page's check is never trusted.
Your AQL filter is held to the schema and type you chose, and every object found is checked again against that type.
No object is changed until every reference to it accepts the new type.
Each step of each object is saved, so a pause or a failure never leaves a second copy, and only one move runs on a site at a time.

Encryption

All traffic between browsers, Jira and the app uses HTTPS (TLS), provided by the Forge platform.
Stored app data is encrypted at rest by Atlassian's Forge storage.

Access control

The app asks only for the permissions it needs: Assets objects, types, attributes and schemas, work items, and its own storage.
Changes made by the app appear in each object's and work item's history.
No one at Systematic has access to your site or your data.

Secure development

Every release is reviewed and tested before it ships, and deployed through Atlassian's Forge pipeline.
The move rules, the permission checks and the recovery from failures are covered by automated tests, and every release is moved end to end on a test site.
Each release is scanned with Atlassian's Forge Security Requirements Tester and checked for vulnerable dependencies, leaked secrets and insecure code.

Reporting a vulnerability

If you think you have found a security issue in Move Objects, write to info@systematic.com.lb with the subject Security. Include the steps to reproduce it and, if you can, your Jira site address.

We confirm receipt within one business day.
We investigate every report and keep you informed until it is resolved.
Critical issues are fixed as a priority and released as soon as a fix is ready.
Please do not share the issue publicly until it is fixed.

Security incidents

If a security incident affects your data, we notify affected customers and Atlassian without undue delay and follow Atlassian's incident handling process for Marketplace apps.