Security Policy

Last updated: 2026-07-03

ThreadOpen for Jira ("the app") is provided by Tech Lake Systems Sp. z o.o. ("we", "us", "the vendor"), a limited liability company registered in Poland (European Union). This page describes how the app is built, hosted, and secured, and how to report a security concern to us.

Hosting model — no vendor servers

The app is an Atlassian Forge app. It runs entirely on Atlassian's Forge platform and stores its data in Atlassian-managed infrastructure. We operate no servers, databases, or storage of our own, so there is no vendor-side infrastructure to breach, misconfigure, or leave unpatched. The platform's runtime, storage, and network controls are managed by Atlassian under its Trust & Security program.

Data protection

Encrypted at rest. All app data lives in Atlassian Forge key-value storage (KVS), encrypted at rest by Atlassian. The app writes no data to any location outside Atlassian's infrastructure.
Encrypted in transit. All network communication — between the app and Atlassian, and between the app and the Slack Web API — is over HTTPS/TLS.
Installation-scoped. Every stored record is scoped to the specific Atlassian site / app installation that created it. One customer's data is never accessible to another installation.

Least-privilege access

The app requests only the minimum permissions required to function. It holds exactly two Forge scopes:

Scope	Access	Why it's needed
`read:jira-work`	Read-only	Read the project list (to map a project to a Slack channel) and an issue's summary (used as the parent Slack message). The app never writes to Jira and reads no comment bodies, attachments, or worklogs.
`storage:app`	Read + write	Persist the app's own configuration in Forge KVS: channel mappings, the Slack connection, thread metadata, and the audit log.

The app's only outbound network destination is the Slack Web API (https://slack.com), declared as an explicit Forge egress permission. It does not access Atlassian Personal Access Tokens (PATs), user passwords, or any other shared secret.

Secrets and authentication

The only long-lived secret the app handles is the Slack bot OAuth token for a connected workspace. It is:

obtained through Slack's standard OAuth 2.0 authorization flow, initiated by a workspace admin;
stored encrypted at rest in Forge KVS, scoped to the installation;
used only to post thread messages and read channel metadata on the workspace's behalf;
revoked at Slack and deleted from storage immediately when an admin disconnects the workspace, and again on app uninstall via the Forge lifecycle:uninstalled event.

Data residency and subprocessors

App data is hosted on Atlassian's infrastructure (AWS regions managed by Atlassian). The app relies on two subprocessors, both bound by their own data processing and security commitments:

Atlassian — the Forge platform that runs and stores the app (atlassian.com/trust).
Slack (Slack Technologies / Salesforce) — receives the issue summary and link the app posts into your workspace (slack.com/trust/security).

What data is processed, and how transfers are handled under the GDPR, is detailed in our Privacy Policy.

Secure development and maintenance

The app is written in TypeScript under strict mode, with an automated test suite that runs before release.
Because there is no vendor-operated infrastructure, the platform, operating system, and runtime are patched and maintained by Atlassian as part of the Forge platform.
Dependencies are kept current, and releases follow Atlassian's Forge deployment and manifest-review process.

Reporting a security issue

We welcome reports from security researchers and customers. If you believe you have found a vulnerability or a security problem in the app, please email support@threadopen.com with enough detail to reproduce the issue. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.

We aim to acknowledge reports within 3 business days and to keep you informed as we work toward a fix. We ask that you avoid privacy violations, data destruction, and service disruption while researching, and that you only test against installations you own or are authorized to test.

Incident response

If we become aware of a security incident affecting customer data, we will investigate promptly, take steps to contain and remediate it, and notify affected customers and any applicable authorities as required by law (including the GDPR). Because the app stores data only within Atlassian Forge, incident response is coordinated with Atlassian's platform-level controls where relevant.

Scope of this policy

This policy covers the ThreadOpen for Jira app and this website. It does not cover Atlassian's or Slack's own products and infrastructure, which are governed by their respective security programs linked above. The app currently holds no formal third-party certifications (such as SOC 2); we rely on the security posture of the Atlassian Forge platform together with the controls described here.

Contact

For any security question or report: support@threadopen.com.