Security

1. Architecture

• Apps are built on Atlassian Forge and run on Atlassian-hosted infrastructure.
• No egress: apps make no calls to external services and send no data outside Atlassian.
• Any app settings are kept in Forge storage, which follows your site’s data residency.
• Apps request only the Atlassian permissions (scopes) their features need, listed on each Marketplace listing.

2. How we work

• Two-step verification on every account used to build, publish or support our apps.
• Dependencies are kept up to date and checked for known vulnerabilities before each release.
• Every release is tested in a separate development environment before it reaches production.
• We never ask customers for passwords or API tokens.

3. Reporting a vulnerability

Email security@momentra.dev with a description, the affected app and steps to reproduce. We acknowledge reports within 2 business days, keep you updated, and fix confirmed issues in line with Atlassian’s security requirements for Marketplace apps.

We will not take legal action against good-faith research that avoids privacy violations, data destruction and service disruption, and that gives us reasonable time to fix the issue before disclosure.

4. Incident response

If we confirm a security incident affecting customer data, we notify affected customers and Atlassian without undue delay and no later than 72 hours after confirmation, describe what happened and what we are doing about it, and follow up once the issue is resolved.

5. Privacy

How we handle personal data is described in our Privacy Policy.