Security Policy - Quick Issue Import

Introduction

This page describes how Quick Issue Import protects your data: where it runs, what it can access, what it keeps, and how security problems are handled. What the app does with your data is described in more detail in the privacy policy.

The app runs entirely on Atlassian's platform. It has no server of its own, calls no address outside Atlassian, keeps no storage of its own, and sends no data to Webelisys or to any third party.

Where the app runs and where your data goes

Quick Issue Import is built on Forge, Atlassian's platform for cloud apps. Its screen is hosted by Atlassian and runs in your browser, inside Jira. The app has no server-side code at all: no server at Webelisys, and no function running for it on Atlassian's servers.

The Excel or CSV file you choose is read in your browser and is never uploaded. Every request the app makes goes from your browser to the Jira API, through Atlassian's Forge bridge. The app declares no external domain and no remote back end, so it has no way to send data outside Atlassian.

What the app writes, the issues and their hidden mark, is stored by Jira with your issues. It stays in your Jira site and follows the data residency of that site.

Encryption

All traffic between your browser and Jira goes through Atlassian. Under Forge's shared responsibility model, Atlassian encrypts it with TLS and HSTS. The app stores nothing of its own, so there is no app data to encrypt at rest. Your issues, and the mark on them, are protected by Atlassian like the rest of your Jira data. See the Atlassian Trust Center.

Access and permissions

The app requests only the three permissions it needs: reading Jira data such as fields, issue types and the marks of earlier imports; creating issues and their mark; and reading user profiles, to match the Assignee column with the people who can be assigned and to read your own Jira time zone.

Every request is made in your name, with your own Jira permissions. The app cannot do anything in Jira that you could not do yourself: a project where you cannot create issues stays closed to it.

The app also adds a global permission to Jira, Use Quick Issue Import. It is granted to all users by default, never to anonymous visitors, and a Jira administrator can restrict it in Jira's global permissions.

Personal data

To match the Assignee column, the app reads the people who can be assigned in the project: their display name, and their email address only when Jira shows it to you. When a row is matched, the person's Atlassian account identifier is sent to Jira as the assignee of the new issue. To find the issues of an earlier import, the app also reads the account identifier of the person who created them and uses it in a Jira search. It reads your own Jira time zone, so that the dates in its searches match Jira's. The app keeps none of this. It stores no personal data, so there is nothing for it to report to Atlassian's personal data reporting API.

What the app keeps, and for how long

The only thing the app writes besides the issues themselves is a hidden mark on each issue it creates, stored by Jira as an issue property named qii. It lets the app recognise rows already imported, so that importing the same file again does not create duplicates. The mark holds the project key, a shortened SHA-256 fingerprint of the row with a sequence number, a random identifier of the import, and a flag for the last batch. It contains no name, no email address and no text from your rows, and the text of a row cannot be read back from the fingerprint.

The mark stays as long as the issue exists, including after the app is uninstalled, because it belongs to the issue. It disappears when the issue is deleted, and it can be removed with Jira's issue properties API.

Logs and tracking

The app writes no logs: it has no server-side code that could write them. It sets no cookies, uses no analytics and contains no tracking. Webelisys receives no information about your files, your issues or your use of the app. Atlassian, as the platform operator, keeps its own operational records under its own policies.

How the app handles what it reads

The content of your file is treated as data, never as code. Values used in Jira API addresses are encoded, text used in Jira searches is escaped, and the screen is built with Atlassian's UI Kit components, which encode what they display. When the app offers a CSV file of rows to fix, any value that a spreadsheet could run as a formula is neutralised.

The app holds no password, API token or other secret, and never asks for your Atlassian password or API token.

Vulnerability management

Before each release, we run the app's automated checks: its tests, a validation of its manifest, and an audit of its dependencies against known vulnerabilities. The exact versions of its dependencies are fixed in its lock file, and we update them when a security fix is published.

We fix confirmed vulnerabilities within the deadlines of Atlassian's Security Bug Fix Policy for cloud apps, counted from the report or triage:

Critical: within 10 days.
High: within 4 weeks.
Medium: within 12 weeks.
Low: within 25 weeks.

Security problems in the Forge platform itself are fixed by Atlassian.

Security incidents

If we learn of a security incident that affects the app, we report it to Atlassian, as the Marketplace rules require, and we inform the affected customers.

Reporting a vulnerability

To report a security problem, write to contact@webelisys.fr with "Security" in the subject. Please describe the problem and how to reproduce it, and do not include personal data or the content of your issues. We acknowledge every report within 2 working days.

Certifications

Webelisys holds no security certification for this app: no SOC 2, no ISO 27001, and no completed CAIQ Lite questionnaire. For Atlassian's own certifications, see the Atlassian Trust Center.