Privacy & Security Tab for Jira Data Center Plugin

Privacy

• Does your app store End-User Data outside of Jira Data Center?
  No. This plugin does not store any End-User Data outside of the Jira Data Center environment.
• Does your app process End-User Data outside of Jira Data Center or outside the host environment?
  No. All data processing is done within the customer’s secured Jira Data Center environment.
• Does your app allow customers to request custom End-User Data retention periods?
  No.
• Does your app use any privacy-enhancing technologies (PETs)?
  Not applicable.
• Is your organization a ‘data controller’ under GDPR in relation to this plugin?
  No—customers are the data controllers.
• Is your organization a ‘data processor’ under GDPR in relation to this plugin?
  Yes, to the extent necessary for plugin operation and support.
• Is your organization a ‘business’ under CCPA with reference to this plugin?
  No.
• Does your plugin have any compliance certifications relevant to data privacy/security?
  None at this time.

Security

• Security contact email:
  security@eitzen.at
• Has a CAIQ (Consensus Assessments Initiative Questionnaire) or similar security questionnaire been completed for this product?
  Not applicable.
• Does your plugin access Atlassian Personal Access Tokens, user passwords, or other shared secrets?
  No.
• Integration permissions:
  The plugin requests the minimum permissions necessary for Jira Data Center operation.
• Justification for requested permissions/scopes:
  Permissions are required only for core plugin functionality and have been minimized to reduce risk.
• Data residency:
  All data storage and processing is controlled and located within the customer’s Jira Data Center infrastructure.
• Security vulnerability disclosure:
  Security issues can be reported via security@eitzen.at and will be addressed promptly.