Security Statement
AcceptDeck Security Statement
This page describes the security design and operating practices of AcceptDeck for Jira. It is a transparency statement, not a certification or guarantee.
Architecture and hosting
AcceptDeck is a Forge app. Server-side application functions and app storage run on Atlassian infrastructure. Acceptance packages are stored in Jira issue properties; supporting records such as revision history, user preferences, external-link secrets, and rate-limit counters use Forge hosted storage. AcceptDeck operates no separate customer database or remote application backend.
The static external review interface is hosted on Google Blogger at go.acceptdeck.com. It communicates over HTTPS directly with an Atlassian Forge web-trigger endpoint. No analytics, advertising, or marketing pixels are intentionally configured in that interface.
Controls
| Area | Control |
|---|---|
| Authorization | Authenticated Jira and JSM requests are checked against the current user’s access before the App reads or changes package data. Editing actions are restricted to licensed users with Jira edit permission. |
| External links | Links contain only a random page identifier and the public Forge endpoint address. They have an expiry of no more than 90 days, can be revoked, and are checked on every external API request. |
| Mandatory password | Every external page requires a separately shared 15–128 character password. The App stores a salted scrypt verifier rather than plaintext and issues a signed browser session for at most 24 hours after successful unlock. |
| Attachments | Downloads are allowed only for attachments explicitly included in the package and confirmed to belong to the related Jira issue. |
| Abuse protection | External links are subject to per-link request throttling. Inputs and identifiers are validated before processing. |
| Secrets | Review credentials and signing material are stored with Forge secret storage. The App does not collect Atlassian passwords, personal access tokens, or user API tokens. |
| Tenant isolation | The App relies on Atlassian Forge installation isolation and scopes every operation to the applicable Jira context, issue, package, and credential. |
| Encryption | Traffic uses HTTPS. Atlassian is responsible for encryption at rest and infrastructure controls for Forge hosted storage under its shared-responsibility model. |
| Supply chain | Supported runtime and dependency versions are maintained and security findings are prioritized under Atlassian’s Marketplace Security Bug Fix Policy. |
Forge permissions
- read:jira-work — read the current Jira issue, summary, permissions, attachments, and acceptance-package issue properties.
- write:jira-work — save or remove package properties and add a Jira comment recording a submitted decision.
- read:servicedesk-request — verify that a Jira Service Management customer may access the related request.
- read:instance-configuration:jira — obtain Jira instance information needed by the external review experience.
- storage:app — store revision history, preferences, link credentials, and abuse-prevention counters in Forge.
Shared responsibility
Atlassian secures the Forge platform, physical infrastructure, hosted-storage encryption, platform tenant separation, and platform availability. AcceptDeck is responsible for its application logic, scope selection, authorization checks, input handling, dependency maintenance, incident handling, and truthful Marketplace disclosures. Customers are responsible for Jira configuration, user access, package contents, recipients, review-link handling, and timely revocation.
Security reporting
Report a suspected vulnerability privately to security@acceptdeck.com. Include affected URLs or components, reproduction steps, impact, and supporting evidence. Do not include real customer data when test data is sufficient.
We aim to acknowledge security reports within 8 business hours, Monday through Friday, GMT+00. Please allow reasonable time to investigate and remediate before public disclosure. Do not perform destructive testing, access data belonging to others, degrade service, use social engineering, or violate law. We will notify Atlassian of qualifying incidents through its required security-incident channel.
Certifications
AcceptDeck does not currently claim independent SOC 2, ISO 27001, HIPAA, FedRAMP, penetration-test, or bug-bounty certification. Atlassian’s certifications do not automatically certify AcceptDeck.
Contact
Security: security@acceptdeck.com
Privacy: privacy@acceptdeck.com
Support: support@acceptdeck.com
