QuinTek
Security apps for Atlassian Cloud that never hold your data.
We build access review, audit, and compliance apps for Jira Cloud on Atlassian Forge. They run entirely inside Atlassian’s infrastructure — which means the answer to “where does our data go when we install this?” is that it doesn’t go anywhere.
The architecture is the product
An app that cannot reach your data cannot leak it.
Most Marketplace apps are a web service wearing an Atlassian badge: your content is copied out to a vendor’s cloud, processed there, and stored there. That is a trust decision, a subprocessor, and a breach surface you inherit.
Forge lets an app run inside Atlassian instead. We take that constraint seriously enough to design around it, which is why our apps qualify for Atlassian’s Runs on Atlassian programme — a badge granted on architecture, not on a questionnaire.
- 01
No vendor cloud
Every line of app code executes on Atlassian-operated infrastructure.
- 02
No outbound calls
No analytics SDK, no error reporting service, no telemetry leaving your tenant.
- 03
No shared storage
Data is isolated per installation by construction, not by a filter in our code.
Jira Cloud · Access review & compliance
Every permission in Jira, and where it came from.
Jira will tell you that someone can administer a project. It will not tell you why. Permission Audit resolves the whole chain — account to group to project role to permission scheme grant — for every account on your site, and puts the derivation in a column you can hand to an auditor.
- Every account, including the ones with nothing. The scan enumerates the whole user directory — active, deactivated, and app principals — rather than working backwards from grants. An account with zero access is reported as zero access, which is how you confirm an offboarding actually worked.
- People and apps, reported separately. Installed apps that can act on your site get their own population, their own review, and their own findings. Most access reviews never look at them.
- Findings that lead somewhere. Accounts holding sensitive permissions, deactivated people who still have access, projects no account can reach, and the accounts with the widest reach across the estate.
- Honest coverage reporting. If a permission scheme, project role, or group could not be read, the report says so and names what was missed. A silently partial answer is worse than no answer, and this is the one thing a compliance tool must never get wrong.
Permission Audit is in final release preparation. Ask to hear when it ships.
The catalogue
Apps we ship
One app today, more in build. Each one solves a question an Atlassian admin is already answering by hand.
Permission Audit
Who can access this project, and how they got that access.
An access review for Jira Cloud that reports the effective permissions of every account on your site — and shows the exact chain of group, role, and scheme that produced each one. Runs entirely inside Atlassian. Nothing leaves.
View appMore on the way
We are building out a family of security and compliance apps for Atlassian Cloud, all on the same architecture. If there is a review you are doing in a spreadsheet today, we would like to hear about it.
Tell us what you need →How we build
Four rules we do not bend
Nothing leaves Atlassian
Our apps are pure Forge. The code runs on Atlassian’s infrastructure, the data stays in Atlassian’s storage, and there is no QuinTek server in the path — because we do not operate one.
Read-only by default
A security tool that can change your configuration is a security tool that can break it. Ours report; they do not grant, revoke, or edit.
No API tokens, ever
We will never ask an administrator to paste a personal access token. Atlassian’s Marketplace Security Enforcement Policy prohibits it, and any vendor asking should be declined.
Say what was actually checked
If something could not be read, the report names it. A confident answer built on a partial scan is the most dangerous output a compliance tool can produce.
Evaluating us for a security review?
Start with the security page — it describes what our apps can reach, what they store, and where. If it does not answer your question, ask us directly and we will answer in writing.