What we hold, and what we cannot

Zero external systems

Change Guards is an Atlassian Forge app that declares no external permissions. Forge refuses an outbound call to any host not declared in the app’s manifest, so this is enforced by the platform rather than promised by us. Two further gates back it up in our own codebase: outbound calls are banned by lint, and by a static analysis rule that runs on every change.

The practical consequences:

• No external database. Governance data lives in Forge storage, inside your own Atlassian site.
• No mail transport. Notifications are Jira’s, under your own scheme.
• No analytics, telemetry or error tracking. Not disabled by configuration — impossible by construction.
• No CDN, fonts or third-party scripts in the app interface. It is Atlassian’s own components.
• No subprocessor other than Atlassian, whom you have already assessed, because you are running Jira.

What the app stores

Inside your Atlassian site, keyed to your Jira issues:

• Governance data — risk, change type, impacted service, planned window, governance status.
• Approvals — the Atlassian account ID and display name of the person asked, their role, decision and any comment.
• Freeze windows — name, dates, reason, who created them.
• The audit chain — for every action: what happened, when, and who did it.

The personal data in that list is Atlassian account IDs, display names, and whatever people write in an approval comment. That is the whole of it. No email addresses, no passwords, no IP addresses.

Where it lives

Wherever your Atlassian site is hosted — a region you chose with Atlassian, which we cannot override, move or copy elsewhere. Data residency is inherited from your site rather than decided by us.

What we can see

Nothing. There is no operator console, no support impersonation and no query path into customer data. If you need us to look at something, you show it to us.

Permissions the app asks for

Almost every call the app makes is made as the signed-in user, so Jira’s own permissions apply underneath ours and nobody can see through the app what they could not see in Jira. Two reads are made as the app itself — project role membership, and a user’s group membership — because those need rights an ordinary agent does not have, and the answer is about that very agent. The app returns only the resulting yes or no.

The audit chain

Each entry carries a SHA-256 hash over its own contents and the hash of the entry before it, from a genesis value derived from the project. Verification recomputes the chain and detects an altered entry, a re-pointed entry, and a removed one.

Backups

Forge storage offers app developers no backup, snapshot or point-in-time recovery. Atlassian protects the platform for their own continuity; that is not a restore path we can invoke for one installation.

Your change records are Jira issues and are covered by Jira’s own protection. For the governance metadata and audit chain, the recovery mechanism available to you is the evidence export — portable, self-verifying and readable without the app. Taking one periodically is worth building into your routine, and we would rather say so plainly than let you discover it during an incident.

Questions from a security review

Send them to support@itsm-ltd.com. Atlassian’s own attestations for the platform — SOC 2, ISO 27001 and the rest — are published in the Atlassian Trust Center and cover the infrastructure this app runs on.