Security Policy
Architecture
Task Hub for Jira is an Atlassian Forge app and carries the Runs on Atlassian badge. In practice, this means:
- No external infrastructure. The App’s code runs on Atlassian’s Forge platform. C4F operates no servers, databases or APIs for the App.
- No data egress. The App makes no outbound network calls. Your data never leaves Atlassian.
- Atlassian-managed storage. Task Hub settings are stored in Forge storage, isolated per installation and covered by Atlassian’s encryption at rest and in transit and by its data residency.
- User-context access. Work items are read and written as the signed-in user, so Jira’s own permissions always apply. The App uses its own identity only for read-only configuration lookups, such as workflow schemes and the rank field. Users can’t see or change work items they couldn’t access in Jira.
- No credentials. The App never asks for passwords, API tokens or personal access tokens.
See Atlassian’s Forge shared responsibility model for the parts Atlassian is responsible for.
Permissions (OAuth scopes)
| Scope | Why the App needs it |
|---|---|
read:jira-work |
Read work items, fields, statuses, spaces and JQL results to show the views |
write:jira-work |
Create, edit, transition, rank, comment on and link work items from the views |
write:issue:jira-software |
Rank work items and work with agile fields such as sprints and epics |
read:jira-user |
Show assignees and avatars, and resolve the members of a Task Hub |
manage:jira-configuration |
Read workflow and status configuration for column mapping, and check admin permissions. The App never changes your Jira configuration. |
read:servicedesk-request |
Group and color Jira Service Management requests by request type |
storage:app |
Save Task Hub settings in Forge storage |
Access control inside the App
- Every Task Hub is public (anyone who can browse the space) or private (only listed members and administrators).
- Only Jira administrators, space administrators and Task Hub administrators can change a Task Hub’s configuration.
- Permission checks happen on the server side, in Forge functions, as well as in the UI.
Secure development
- Code is version-controlled and changes are reviewed before release.
- We keep dependencies up to date and fix known vulnerabilities based on severity.
- Releases go through Forge’s development, staging and production environments.
Certifications
C4F doesn’t hold SOC 2 or ISO 27001 certifications. Because the App runs on Forge with no egress, the infrastructure security controls that apply are Atlassian’s own.
Incident response
If we learn of a security incident that affects customer data, we’ll notify affected customers and Atlassian without undue delay, and in any case within 72 hours of confirming it. We’ll describe what happened, what data was involved and what we’re doing about it.
Reporting a vulnerability
Email security@c4ftech.com with steps to reproduce. We acknowledge reports within 3 business days and keep you updated until the issue is fixed. Please don’t publicly disclose an issue until we’ve released a fix. We won’t take legal action against good-faith research that respects user privacy and doesn’t degrade the service.