Plumbworks / Security
Your data never leaves your Atlassian tenant.
This page exists because a security reviewer will ask, and you should be able to send them a link instead of filling in a questionnaire. Everything below is a factual description of how the apps are built, not a statement of intent.
Architecture
Every Plumbworks app is built on Atlassian Forge. Forge apps execute inside Atlassian's own infrastructure rather than on vendor-operated servers. There is no Plumbworks application server, no Plumbworks database, and no Plumbworks cloud account holding customer data.
This is not a policy we could change quietly. It is a property of the platform: Forge apps declare an explicit permissions manifest, and any external network call must be declared in that manifest and shown to the administrator at install time. Our manifests declare none.
At install, Atlassian shows every permission and every external domain an app requests. If our apps requested egress, you would see it on that screen. You do not need to take our word for it.
What the apps read
Each app requests the minimum scopes needed for its function, and all of them are read-only.
read:jira-user— account IDs, display names, email addresses where visible, account type, active status.read:jira-work— issue metadata, comments and changelog entries, used to derive activity dates.storage:app— Forge's own key-value store, used to cache scan results inside your tenant.
None of our apps request write scopes. They cannot modify, delete or create anything in your instance. Where a future version introduces cleanup actions, those will arrive as a separate, optional permission grant that you may decline while continuing to use the reporting.
Personal data
Display names and email addresses are read in order to render a report an administrator can act on. They are held only in Forge storage within your tenant and are never transmitted elsewhere. Email addresses hidden by a user's Atlassian profile privacy settings are not visible to the app at all.
Data residency
Forge hosted storage inherits Atlassian's data residency. App data is stored in the same region you have pinned your Atlassian products to, in all currently supported regions. If your Jira data is pinned to the EU, so is anything our apps cache.
Who can see the reports
The apps install as Jira admin pages. They are reachable only from Jira administration settings, which means only site administrators and users with the relevant admin permission can open them. Ordinary users cannot see licence reports, dormancy data or configuration findings.
Retention and deletion
Scan results are stored in Forge app storage inside your tenant and overwritten on each scan. When you uninstall an app, Atlassian removes its Forge storage. There is nothing on our side to request deletion of, because there is nothing on our side.
The one exception is support correspondence. If you email us, that email exists in our inbox like any other business correspondence, and is covered by the privacy policy.
Subprocessors
We use no subprocessors for customer data, because no customer data reaches us. Atlassian is the sole processor, under your existing agreement with them.
For company operations we use standard business services for email and payments. None of these ever receive data from your Atlassian instance.
Reporting a vulnerability
Email team@plumbworks.app with enough detail to reproduce. We will acknowledge within two working days and keep you updated until it is resolved. We will not pursue legal action against good-faith research that avoids privacy violations, service degradation and data destruction.
Plumbworks does not currently hold SOC 2, ISO 27001 or any third-party security certification, and this page does not claim otherwise. If your procurement process requires one, tell us — it affects how we prioritise it.