Security & data
| Question | Answer |
|---|---|
| Where does the app run? | Entirely on Atlassian Forge ("Runs on Atlassian"). There are no servers of ours and no outbound connections from the app. |
| Where is data stored? | Forge SQL and Forge storage, hosted by Atlassian in your Jira site's data residency region. |
| What does CI send? | Commit SHAs and parents, subjects, the first 2,000 characters of commit messages, author display names (optional, --no-authors), dates, tag names, repository and CI run URLs. Never source code, diffs or email addresses. |
| How are pushes authenticated? | HMAC-SHA256 over timestamp + body with a per-site secret, constant-time comparison, 5-minute replay window. Secrets live in Forge's secret store and can be rotated or revoked by admins. |
| Do you store GitHub/GitLab tokens? | No. Shipped never connects to your git host. |
| Who can see issue details? | Issue summaries and statuses are loaded as the viewing user, so people only see issues they're allowed to browse. |
| Retention | Raw uploads are deleted right after processing; the ingest log after 30 days. Releases, test states and the audit log are kept while the app is installed. |
| Can the developer access our data? | No. Forge does not give app developers access to customer data. |
| Audit trail | Every test-state change, release close/reopen, secret rotation and settings change is recorded with who and when. |
Report a vulnerability: security@shipped-app.dev.