Security Policy

Last updated: 11/08/2026

Platform security

Teams Digest for Jira is built entirely on Atlassian's Forge platform. We do not operate any separate servers, databases, or infrastructure outside of Forge. Application code runs inside Atlassian's own sandboxed runtime, and all persisted configuration data is stored using Forge's built-in Key-Value Store, isolated per installation.

Authentication

The app authenticates to Jira using Forge's built-in app identity (asApp()). We never request, collect, or store Atlassian Personal Access Tokens, account passwords, or any other shared secrets from end users.

Outbound data transmission

The app transmits Jira issue summary data to a Microsoft Teams Workflow webhook URL that the administrator explicitly configures. This is a core, requested function of the app — data is sent only to the destination the customer specifies, over HTTPS.

Least-privilege permissions

The app requests the minimum Jira API scopes required to function: read-only access to issues (read:jira-work) and app-scoped storage (storage:app). It does not request write access to your Jira data.

Vulnerability reporting

If you believe you've found a security issue in this app, please report it to support@teamsdigestforjira.com. We will acknowledge reports within 2 business days and work to address confirmed issues promptly.

Incident response

In the event of a confirmed security incident affecting customer data, we will notify affected administrators via the contact information on file as soon as reasonably possible, and no later than required by applicable law.

← Back