Security

On Behalf is built on Atlassian Forge and runs entirely on Atlassian's infrastructure. This page explains how the app protects your data and how we handle security issues. For what the app stores and why, see Privacy and data.

Where the app runs

• The app's code runs on Atlassian Forge, inside Atlassian's cloud. Systematic runs no server for it.
• It is eligible for the Runs on Atlassian program: it has no egress, sends nothing outside your site and uses no third-party services.
• Data residency follows your Atlassian site: the app's storage lives where Atlassian keeps your site's Forge data.

Who can raise for whom

• A customer can only pick a colleague who shares one of their organizations, and only organizations added to the service project. An admin can narrow this to chosen organizations.
• The choice made on the form is checked again on the server before anything changes. A request edited to name someone outside the customer's organizations is refused and left as it was.
• Only the customer who filled in the form can pass a request on.
• The person who raised the request is added to it before it changes hands, so they never lose access to it.

Data handling

• The app stores only its settings and a 90-day activity log of account IDs, request keys and results.
• The colleague picker returns names only, never email addresses, and only for members of the customer's own organizations.
• Account IDs are reported weekly through Atlassian's personal data reporting API, so closed accounts are removed.

Encryption

• All traffic between browsers, Jira and the app uses HTTPS (TLS), provided by the Forge platform.
• Stored app data is encrypted at rest by Atlassian's Forge storage.

Access control

• The app asks only for the Jira permissions it needs: reading and editing requests, reading users and organizations, and its own storage.
• Changes are made by the app's own account and appear in each request's history.
• Only Jira administrators can open the admin page and change settings.
• No one at Systematic has access to your site or your data.

Secure development

• Every release is reviewed and tested before it ships, and deployed through Atlassian's Forge pipeline.
• The rules for who may raise for whom are covered by automated tests.
• Dependencies are kept up to date and checked for known vulnerabilities before each release.

Reporting a vulnerability

If you think you have found a security issue in On Behalf, write to info@systematic.com.lb with the subject Security. Include the steps to reproduce it and, if you can, your Jira site address.

• We confirm receipt within one business day.
• We investigate every report and keep you informed until it is resolved.
• Critical issues are fixed as a priority and released as soon as a fix is ready.
• Please do not share the issue publicly until it is fixed.

Security incidents

If a security incident affects your data, we notify affected customers and Atlassian without undue delay and follow Atlassian's incident handling process for Marketplace apps.