Cloud Security Statement

1. Purpose and summary

This statement describes the security posture of Service Transition & Readiness (the “App”), published on the Atlassian Marketplace by ITSM Ltd (company number 17339600). It is written to support your security review and to be shared with your risk, procurement and information security teams.

The single most important fact about this App’s security model is that it holds no data outside Atlassian. The App is built entirely on Atlassian Forge. We operate no servers, no databases and no hosting infrastructure for it. The App makes no outbound calls to systems we control. As a result, most of the questions a security review would normally ask about a vendor’s hosting environment are answered by Atlassian’s own controls, not ours.

At a glance

2. Architecture and hosting

2.1 The App is a Forge app. Its backend logic executes as serverless functions on compute operated by Atlassian; its user interface renders through Forge UI modules within the Atlassian product.

2.2 We do not provision, operate, patch or monitor any infrastructure for the App. Operating system patching, runtime patching, network security, physical security, capacity and availability of the underlying platform are Atlassian’s responsibility.

2.3 The App contains no Atlassian Connect modules and no externally hosted components.

2.4 Shared responsibility. Atlassian secures the platform. We are responsible for the App’s own code, its declared scopes, its data handling logic, its dependencies and its release process. You are responsible for administering user access within your Atlassian site, for the content your users place in it, and for deciding whether the App is appropriate for your data.

3. Data storage, encryption and residency

3.1 Storage. All data the App persists is written to Forge hosted storage (the key-value store and entity store). Storage is automatically scoped per installation by the platform; the App cannot read another tenant’s stored data.

3.2 Encryption. Data in Forge hosted storage is encrypted at rest by Atlassian in line with Atlassian Cloud’s data encryption standards. Data in transit between your browser, the Atlassian product and the App’s functions is protected by TLS 1.2 or above, terminated by Atlassian. These are platform-provided controls; we do not implement or override them.

3.3 Secrets. Any credentials or secrets used by the App are stored in the Forge encrypted environment variable store. No secrets are held in source code, in the App manifest, or in any repository.

3.4 Data residency. Forge hosted storage inherits the data residency configuration of the Atlassian product it is installed alongside. Where you have pinned Jira or Confluence data to a specific Atlassian region, in-scope App data is pinned to the same region and migrated with your product data if you relocate. Data residency is administered by Atlassian; the current list of supported regions is published by Atlassian.

3.5 Backup and recovery. Atlassian Cloud backs up persistent storage for disaster recovery purposes. We hold no independent backup of your data and cannot restore data deleted through your Atlassian site or by uninstalling the App. Recovery objectives are those of the Atlassian platform; we do not offer separate RTO or RPO commitments.

3.6 Deletion. When the App is uninstalled, Forge app data is deleted by Atlassian under its platform deletion processes. We retain no copy.

Where an administrator has enabled publishing to Jira, the App also writes status values onto Jira issues as entity properties. Those are your Jira data rather than Forge app data, and the sentence above does not cover them. Turning publishing off removes the properties the App wrote. The Forge platform provides no uninstall hook, so once the App is uninstalled it has no means of removing them: turn publishing off before uninstalling if you want them removed. A property left behind contains a closed set of status words, dates, counts and the time the service’s record last changed, and no personal data, and you can remove it yourself at any time — the App’s documentation gives the method.

4. Data egress

4.1 The App’s manifest declares no external egress permissions. The Forge platform blocks outbound network traffic to any domain not explicitly declared, and Atlassian reviews declared egress at app approval. Because the App declares none, it cannot transmit customer data to any destination outside Atlassian’s infrastructure.

4.2 This includes analytics, telemetry, error reporting and logging: none of these send customer data to us or to a third party. We use no third-party analytics or tracking.

4.3 No artificial intelligence or machine learning. The App contains no AI or machine learning features. It makes no calls to any large language model or inference service, whether Atlassian’s or a third party’s. Customer data is not used to develop, train, fine-tune or evaluate any model, by us or by anyone else. This is stated as a contractual undertaking in clause 4.4 of the Data Processing Agreement.

5. Permissions and least privilege

5.1 The App requests only the OAuth 2.0 scopes it needs. The scopes it requests are:

5.2 The App calls Atlassian product APIs as the acting user (asUser()) wherever the operation permits, so that the App cannot see or change anything the user could not see or change themselves. Where an operation must run with app-level permissions (asApp()) because no user is present, it is limited to the following, and to nothing else:

1. A daily scheduled background job. It executes the customer-configured JQL query with read-only POST /rest/api/3/search/approximate-count calls and stores only the resulting numeric counts — never issue content. It posts the early-life-support expiry-notice comment described in 5.1. It reads the current key of each issue a service is linked to, and of each project a service belongs to, and stores only a key that has changed, so that a service still finds its issue after the issue moves or the project’s key is renamed. Where publishing to Jira is switched on, it repairs the published status property described in the Privacy Policy.

2. Publishing. Where your administrator has switched on publishing to Jira, the App writes the status property on linked issues when a service changes and when publishing is switched on, and deletes it when your administrator uses Remove published data.

Apart from the expiry-notice comment (5.1) and the status property in item 2, none of these makes a write call to Jira.

5.3 The App does not request, collect or store Atlassian passwords, API tokens or Personal Access Tokens.

5.4 Any change that adds a scope requires your site administrator’s explicit approval before the new version is installed.

6. Access control and our access to your data

6.1 We have no routine technical means of accessing your data. The App exposes no administrative back door, no support console and no data export facility to us.

6.2 The only way we see your data is if you send it to us — for example a screenshot, log extract or exported record attached to a support email. We ask customers not to send more than is necessary to diagnose an issue, and we handle such material in accordance with our Privacy Policy.

6.3 Access to our own systems (source control, Atlassian developer console, support inbox) is restricted to named personnel, protected by multi-factor authentication, granted on a least-privilege basis, reviewed quarterly and revoked on the day a person leaves.

6.4 Personnel are subject to written confidentiality obligations and receive security awareness training annually.

7. Secure development

7.1 Source code is held in a private repository with branch protection and mandatory peer review before merge to the release branch.

7.2 Dependencies are scanned automatically for known vulnerabilities using npm audit in GitHub Actions, which runs on every push to every branch — including every pull request’s commits — and on a weekly schedule across both the App’s backend and its front-end package trees, with Dependabot raising weekly update pull requests for each. The build fails on any high or critical finding. The App does not ship with dependencies carrying known critical or high-severity vulnerabilities, and does not use end-of-life Node.js runtimes.

7.3 Static analysis and secret scanning run in the build pipeline. All input is validated and output encoded to guard against injection and cross-site scripting.

7.4 The App is designed not to write personal data into application logs, in line with Atlassian’s mandatory security requirements for cloud apps.

7.5 Development, staging and production Forge environments are separated. Production releases are made only from the protected branch.

7.6 The App participates in Atlassian Ecoscanner, Atlassian’s automated security scanning of Marketplace apps, and undergoes Atlassian’s app and partner security review as part of listing and version approval.

8. Vulnerability management and incident response

8.1 Reporting a vulnerability. Report suspected vulnerabilities to support@itsm-ltd.com. We acknowledge reports within 2 business days and will keep you informed of progress. We ask that you allow us a reasonable period to remediate before public disclosure, and we will not pursue researchers acting in good faith.

8.2 Remediation targets. We remediate confirmed vulnerabilities in accordance with Atlassian’s Security Bug Fix Policy for cloud apps, measured from triage:

These are Atlassian’s published cloud-app timeframes, which Atlassian has stated become enforceable from 1 September 2026. We apply them now. Verify the current policy at Atlassian’s Security Bug Fix Policy page before relying on these figures.

8.3 Incident notification to Atlassian. On discovering or being notified of a security incident affecting the App, we notify Atlassian within 48 hours through Atlassian’s app security incident management process, as required by the Marketplace Partner Agreement.

8.4 Incident notification to you. Where an incident affects your data, we will notify the technical contact on your licence without undue delay and in any event within 72 hours of becoming aware, with the information available at the time, and will provide updates as the investigation progresses. Where we act as processor, we will assist you in meeting your own regulatory notification obligations.

8.5 Patch delivery. Because the App is Forge-only, minor and patch releases propagate automatically across installations without administrator action, so security fixes reach all customers shortly after we deploy them.

8.6 We maintain at least one named security contact registered with Atlassian, as required for Marketplace partners.

9. Certifications — an honest statement

We hold no independent security certification. ITSM Ltd is not certified to SOC 2, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, PCI DSS or any comparable standard, and we do not claim to be.

What we can accurately say is this: the infrastructure on which the App runs is Atlassian’s, and Atlassian holds those certifications for its cloud platform, including SOC 2 Type II, SOC 3, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, PCI DSS and CSA STAR, together with FedRAMP authorisation for its Government cloud. Because the App stores no customer data outside Atlassian’s infrastructure, the controls covered by those certifications apply to the environment holding your data.

You can verify Atlassian’s certifications and obtain reports directly from Atlassian at atlassian.com/trust and customertrust.atlassian.com. We are not able to supply Atlassian’s audit reports on Atlassian’s behalf.

10. Sub-processors

Annex 3 of the Data Processing Agreement is the authoritative sub-processor list, giving full legal entity and location for each; this table is a summary of it. We give 30 days’ notice of changes, under clause 7.2 of that agreement. Our support tool is Atlassian’s Jira Service Management, so Atlassian, listed above, holds support correspondence alongside Google.

11. Business continuity

11.1 Availability of the App depends on the Atlassian Cloud and the Forge platform, and continuity and disaster recovery for that platform are provided by Atlassian. We give no uptime commitment; see section 10 of the Support and Maintenance Description.

11.2 Our own continuity arrangements cover source code (held in a replicated cloud repository with an offline copy retained), release credentials and support access, so that we can continue to release and support the App from an alternative location.

11.3 We commit to maintaining the App actively, including publishing at least one version update within every 18-month period, in line with Atlassian’s requirements for maintained Marketplace apps.

12. Compliance

• UK GDPR and Data Protection Act 2018 — see the Privacy Policy at https://str.itsm-ltd.com/legal/privacy-policy and the Data Processing Agreement at https://str.itsm-ltd.com/legal/data-processing-agreement.
• ICO registration — registered with the Information Commissioner’s Office under number ZC207852.
• Atlassian Marketplace — we comply with the Marketplace Partner Agreement, the Atlassian Developer Terms and Atlassian’s mandatory security requirements for cloud apps.

13. Contact and updates

Security questions, questionnaires and vulnerability reports: support@itsm-ltd.com. We aim to respond to security questionnaires within 5 business days, consistent with the P4 target in the Support and Maintenance Description.

This statement is reviewed at least annually and whenever the App’s architecture materially changes. Where a change materially reduces the security commitments described here, we will give at least 30 days’ notice to the technical contact on your licence, and the change will not apply retrospectively or reduce our obligations during your then-current Subscription Term. Atlassian’s requirements, certifications and remediation timeframes change over time; where this statement describes an Atlassian control or policy, the Atlassian source is authoritative.

---

Published in accordance with the Atlassian Marketplace Partner Agreement. Read alongside the Privacy Policy, End User Terms and Support and Maintenance Description for Service Transition & Readiness.