Security
Every Zovle app runs inside your Jira or Confluence site, next to your team’s work. This page explains how we build for that responsibility, what our apps can and cannot do with your data, and how to report a security problem.
- Runtime
- Atlassian Forge
- Zovle servers
- None. Code runs on Atlassian’s infrastructure.
- Connect modules
- None
- App data
- Forge hosted storage, tied to your site
- Egress
- None declared by default
- Permissions
- Only the scopes each feature needs
- Vulnerability reports
- Acknowledged within 2 business days
On this page
Built on Atlassian Forge
- No Zovle servers. Our apps run on Forge, Atlassian’s hosted app platform. Code executes on Atlassian’s infrastructure, not on machines we operate.
- No Connect. We do not use the older Connect framework, which required apps to run their own servers and receive data from your site.
- Data stays in Atlassian. Anything an app stores lives in Forge hosted storage, tied to your site and covered by Atlassian’s data-residency rules where you use them.
- Egress is declared. Forge apps can only reach external addresses that are declared in the app’s manifest and shown to you before you install. By default our apps declare none. If an app ever needs one, its Marketplace listing will name the destination and the reason.
Least privilege
Each app requests only the Atlassian permission scopes its features need. Apps act with the permissions of the person using them wherever the platform allows, so an app cannot show a user anything Jira or Confluence would not already show them.
How we develop
- Two-step verification on every account that can change our code, our Atlassian developer console or our Marketplace listings.
- Secrets are never committed to source code. Credentials an app needs are held in Forge’s encrypted environment variables.
- Dependencies are kept to a minimum and checked for known vulnerabilities before every release.
- Every change is reviewed and tested before it is deployed to production.
- We follow Atlassian’s security requirements for Marketplace cloud apps and complete its partner security reviews before listing.
Your data when you uninstall
When an app is uninstalled, its data in Forge hosted storage is deleted according to Atlassian’s hosted-storage lifecycle. We do not keep a copy, because we never had one.
Reporting a vulnerability
If you believe you have found a security issue in a Zovle app or on zovle.in, please email [email protected] with the subject line Security report. Include the app name, what you found, and steps to reproduce it.
- We will acknowledge your report within 2 business days.
- We fix confirmed vulnerabilities within the timeframes set by Atlassian’s Security Bug Fix Policy for Marketplace apps, and keep you informed along the way.
- We will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption, and that gives us reasonable time to fix the issue before disclosure.
Please do not access, change or delete other people’s data while testing, and do not run automated scans against customer sites.
Security incidents
If a security incident affects a Zovle app, we will notify Atlassian and affected customers promptly, as Atlassian requires of its Marketplace partners, and explain what happened, what was affected and what we have done about it.
Questions
Security reviewers and procurement teams can email [email protected] for anything this page does not answer. Each app’s Marketplace listing also carries a Privacy & Security tab with app-specific details.