VeriReport — Security Policy

Atlassian Forge app · Runs on Atlassian · no external egress

VeriReport is built and operated by Reglyze. This page describes the app's security posture and how to report a vulnerability. For what data the app accesses and stores, see the privacy & data-handling policy.

Platform & architecture

• VeriReport runs entirely on Atlassian Forge — compute (Forge functions), storage (Forge hosted storage), and AI (Atlassian-hosted models via the Forge LLMs API). Reglyze operates no servers, databases, or third-party services that receive customer data.
• The app declares no external egress in its manifest: no customer data leaves the Atlassian cloud. This is programmatically verified by Atlassian's Runs on Atlassian program.
• Tenant isolation, encryption in transit (TLS) and at rest, network and physical security are provided by Atlassian's cloud infrastructure — see Atlassian Trust.

Least privilege

• The app requests only read-only product scopes — read:jira-work and read:servicedesk-request — plus storage:app for its own Forge storage. It cannot modify Jira/JSM data.
• It never accesses passwords, API tokens, or shared secrets. Authentication and authorization are handled by the Forge platform; the app acts only within the permissions granted at installation, and any future scope change requires explicit admin approval before it takes effect.

Data protection

• No End-User Data is stored or processed outside Atlassian products. App data (generated reports, branding settings) lives in Forge hosted storage, scoped to the installation, and is removed when the app is uninstalled.
• The app does not log End-User Data, shares no data with third parties, and has no sub-processors.
• Data residency follows your Atlassian instance (EU data residency supported); residency migrations are handled by the Forge platform.

Secure development

• The deterministic metrics core is covered by automated tests; changes are reviewed before release.
• Dependencies are kept current and audited (npm audit) as part of the release process.
• Every release passes Forge platform validation, and cloud apps are subject to Atlassian's ongoing Marketplace security scanning (Ecoscanner). A single always-current version is deployed to all customers, so security fixes reach every installation automatically.

Reporting a vulnerability

We welcome good-faith security research. If you believe you have found a vulnerability in VeriReport:

• Email contact@reglyze.com with a description, steps to reproduce, and impact. Please do not disclose publicly before a fix is available.
• We acknowledge reports within 3 business days and keep you informed of progress; credit is given if desired.
• Confirmed vulnerabilities are remediated according to severity, in line with Atlassian's security requirements for Marketplace apps. As a Forge cloud app, fixes deploy to all customers as soon as they are released.

Safe harbor: we will not pursue legal action for good-faith, non-disruptive research — do not access data that is not yours, do not degrade the service, and use a test or development site where possible.

Incident response

If a security incident affects customer data, we notify Atlassian and affected customers without undue delay, in accordance with Atlassian Marketplace partner requirements, including the nature of the incident, its impact, and remediation steps.

Compliance

Reglyze does not currently hold independent security certifications. VeriReport runs exclusively on Atlassian's cloud infrastructure, which maintains SOC 2, ISO 27001 and other certifications (see Atlassian compliance); the app introduces no infrastructure outside it.

Contact

Security contact: contact@reglyze.com.