Security

The safest place for your data is where it already is.

Most Marketplace apps are a web service wearing an Atlassian badge: your content is copied out to a vendor’s cloud, processed there, and stored there. Ours are not. This page describes what that means concretely enough to hand to whoever reviews apps at your organisation.

Where app code runs: Atlassian infrastructure
Where app data lives: Your Atlassian tenant
QuinTek servers in the path: None
Sub-processors for app data: None
Outbound calls from our apps: None
Data residency: Follows your Atlassian site
Diagnostic logs: Held by Atlassian; you control access
API tokens requested: Never
Trackers on this website: None

Pure Forge, by design

Every QuinTek app is a pure Atlassian Forge app. The code runs in Atlassian’s own compute, the data it needs lives in Atlassian’s own storage, and the boundary of the app is the boundary of your tenant.

This is not a hosting choice we could reverse quietly. It is the architectural condition for Atlassian’s Runs on Atlassian programme, which is awarded on how an app is built rather than on a questionnaire it fills in — and it is checked by Atlassian, not asserted by us.

No egress, so no telemetry

Our apps make no outbound network calls to third parties. No analytics SDK, no error reporting service, no feature-flag service, no usage pipeline.

The practical consequence is that we learn nothing about your site unless you tell us. We would rather have less product data than have a channel out of your tenant that we have to ask you to trust.

Read-only with respect to your configuration

Our apps report; they do not change anything. They never create, modify, or delete a permission scheme, a role, a group, a grant, or an account, and every scope they request is listed and justified on the app’s own security page.

One honest complication: an app that needs to read group membership has to declare an admin-level scope, because the product permission that allows the read is only granted to apps in that position. Permission Audit declares one, and the consent screen will show it. The app calls no endpoint that writes, and we would drop the scope the day Atlassian offers a read-only route to the same permission.

Storage is isolated per installation

What our apps persist — derived results, not copies of your configuration — is stored in Forge SQL, Atlassian’s managed database, walled off per installation by construction rather than by a filter in our code.

Another customer’s installation cannot address your data. There is no shared store for it to address.

No API tokens, ever

We will never ask an administrator to paste a personal access token. Atlassian’s Marketplace Security Enforcement Policy prohibits the pattern outright.

Worth generalising beyond us: any Marketplace app asking for an API token is asking for standing credentials to your site. That is grounds to decline it, whatever the app does.

We tell you what our apps themselves hold

At install, Atlassian places app principals that request admin-level scopes into an administrator group on your site. The effect is that such apps hold Administer Jira — reached by exactly the route people assume is closed to a non-human account.

This is standard Atlassian behaviour, it applies to many apps already on your site, and it applies to ours. Permission Audit reports it, including about itself. An access-review tool that exempted itself from its own report would not be worth installing.

Diagnostic logs, and the switch that controls them

There is one channel by which anything about your installation can reach us, and it is Atlassian’s, not ours: the diagnostic log that every Forge app writes. Atlassian stores it and, by default, lets the app’s developer read it. Ours carries scan identifiers, group names, timings, counts, and error text. It does not carry the report, and it is written to avoid names and email addresses.

You can turn our access off. In Atlassian Administration, under Apps → Connected apps, each app has a “Logs access” setting. Switch it off and the log stops appearing in our console; support then works entirely from what you choose to send us, which is a perfectly workable way to run it.

Where the data sits, and how it is protected

Forge hosted storage keeps an app’s data in the same Atlassian location as the site it is installed on, in every location Atlassian offers, and moves it when the site moves. Data residency is therefore inherited rather than implemented: if your site is pinned to a region, our apps’ data is pinned with it, and we cannot choose otherwise.

Encryption in transit and at rest, backups, key management, and physical security are Atlassian’s controls, applied to our apps’ storage exactly as they are to your own Jira data, and covered by Atlassian’s certifications. We do not claim them as ours. We chose the architecture in which they are the only ones that matter.

For your review

The Marketplace Privacy & Security tab, answered here too

Does the app store End-User Data outside of Atlassian products and services?: No. Everything the app persists lives in Forge hosted storage inside your installation.
Does the app process End-User Data outside of Atlassian products and services, or outside the user’s browser?: No. Every function runs on Forge compute; there is no QuinTek-operated service.
Does the app expose any remote REST APIs?: No.
Does the app support data residency?: Yes, by inheritance. Forge hosted storage is pinned to the same location as your Atlassian site, in every location Atlassian offers, and migrates with it.
Does the app log End-User Data?: Its diagnostic log carries scan identifiers, group names, timings, counts, and error text — not the report, and not names or email addresses. Atlassian holds the log; you can revoke our access to it.
Does the app share End-User Data with any third party, including sub-processors?: No. There is no third party in the path.
Does the app store End-User Data after uninstall?: No. Its storage is removed by Atlassian along with the installation; QuinTek holds nothing to delete.
Does the app access Personal Access Tokens, passwords, or any shared secret?: No, and it never will ask for one.
Is QuinTek a data controller or data processor under the GDPR, or a business or service provider under the CCPA, for this app?: Neither. No End-User Data is disclosed to QuinTek by the app, so there is nothing for a DPA to govern. We will confirm that in writing on request.
Compliance certifications?: None yet. We will say so rather than imply otherwise; the platform the app runs on carries Atlassian’s.
Security contact?: support@quintek.com, with “security” in the subject. Our disclosure commitments are below.

Vulnerability disclosure

Tell us and we will answer.

If you believe you have found a security issue in a QuinTek app or in this site, email support@quintek.com with “security” in the subject. Include what you found, how to reproduce it, and how you would like to be credited.

What you can expect from us:

Acknowledgement within two business days, from a person who can act on it, and a first assessment of severity.
A fix within the timeframes Atlassian sets for apps on the Marketplace, which run from days for a critical issue to weeks for a low one, and an update to you when it ships.
Notification to Atlassian within 48 hours of confirming a security incident, as the Marketplace Partner Agreement requires, and prompt notice to any affected customer, with what happened and what we did.
Credit, if you want it, once the fix is released.

Please give us a reasonable window to fix an issue before disclosing it publicly, and please do not access, modify, or exfiltrate data belonging to anyone else while testing. We will not pursue anyone who reports in good faith within those bounds.

For your review

Questions we will answer in writing.

Vendor security questionnaires are part of the job and we do not treat them as an imposition. If your review needs something this page does not cover — data flow detail, sub-processor confirmation, an architecture statement for a specific app — ask.

Where the honest answer is “we have not done that yet”, that is what you will get. A vendor who claims every certification on the list is telling you something about their answers, not their controls.

Ask a security question

Per-app detail

Everything above holds for every app we ship. Each app’s documentation also carries its own security page describing exactly what that app reads, what it stores, and what it does not.

Permission Audit — security and data handling →