Security Policy
Effective 2026-07-28 · Piped Creations ("we", "us")
Short version: our apps hold no infrastructure of our own. Everything runs inside Atlassian Forge, all access is least-privilege and performed as the requesting user, and no customer data ever leaves Atlassian's cloud. The strongest security control we have is the data we never touch.
1. Scope and posture
This policy covers True Time in Status for Jira (the "App") and the pipedcreations.com website. Piped Creations is a small independent software business. We operate no servers, networks, databases, or data centres in the delivery of the App; Atlassian's Forge platform provides the entire runtime and storage layer, and Atlassian secures and patches it.
We state our controls plainly and only claim what we actually do. Where an enterprise practice does not apply to an operation of this size and shape, we say so rather than implying otherwise.
2. Architecture and data flow
- No data egress. The App makes no requests to any non-Atlassian host. There is no external backend, no third-party analytics, and no telemetry. The App is eligible for Atlassian's "Runs on Atlassian" designation.
- No customer data at rest outside Atlassian. Issue and changelog data is read on demand, used to render the report requested, and discarded. It is never persisted by us.
- All processing in-region on Atlassian infrastructure. App storage is Forge-hosted and inherits Atlassian's encryption at rest and in transit.
3. Access control
- Least privilege by scope. The App requests exactly two
scopes:
read:jira-work, to read the issue changelogs the report is computed from, andstorage:app, to save the user's own calendar settings. No write access to Jira is requested or held. - Acts as the user, never elevated. Every Jira read uses
Atlassian's
asUserauthorization, so the App can only ever see issues the person viewing the report could already open themselves. Results are never cached across users or shared between them. - Administrative access. Access to the Atlassian developer console, the Marketplace partner account, the source code, and the domain is limited to a single named individual, the owner. There are no employees, contractors, or shared credentials. Accounts are protected by two-factor authentication.
- Subprocessors. We use no subprocessors that receive customer data. The App's only data processor is Atlassian itself.
4. Secure development
- Automated tests gate every release. The calculation engine carries a unit test suite plus golden tests covering daylight-saving and timezone edge cases, and a type check must pass before a build is produced.
- Manual verification before deployment. Releases are verified end to end against a live Jira site using a written verification matrix covering each user-facing surface.
- Minimal dependency surface. The App's runtime
dependencies are Atlassian's own
@forge/*packages and a first-party internal calculation module. We take on third-party runtime libraries only where unavoidable, which keeps supply-chain exposure close to nil. - No secrets in the App. The App collects no passwords, personal access tokens, or API keys from users, and holds no credentials of its own; authorization is delegated entirely to Forge.
5. Logging
Application logs are produced by the Forge platform and are readable only through the Atlassian developer console by the single owning account. Logs are not exported, forwarded, or shared with any third party. We do not log issue contents.
6. Vulnerability reporting
If you believe you have found a security issue in one of our apps, email support@pipedcreations.com with the subject line SECURITY. Please include enough detail to reproduce the issue. We will acknowledge your report, keep you informed while we investigate, and credit you if you would like us to. Please do not disclose the issue publicly until a fix is available.
We ask that testing be limited to your own Atlassian site and that you avoid accessing data belonging to other people while investigating.
7. Incident handling
If we become aware of a security incident affecting the App, we will investigate promptly, remediate by deploying corrected code, and notify affected customers and Atlassian as required. Because the App stores no customer data outside Atlassian's own infrastructure and holds no credentials, the realistic incident surface is limited to defects in the App itself and to the security of the owner's Atlassian account.
8. Business continuity
Availability of the App is provided by Atlassian Forge; we run nothing that could independently go down. Our recovery obligation is limited to redeploying the App from source, which is version-controlled and retained independently of any hosting provider. App data is held in Forge storage and is covered by Atlassian's own durability guarantees.
9. Changes
If this policy changes, we will update this page and its effective date.