Data Processing Addendum

Revised: 14 November 2026

1. Incorporation, parties and roles#

This DPA forms part of the End User Terms for Config Health Guardian for Jira between Shai Shmuel Laish, an individual operating at אהבת אדם 77, דירה 2, כפר יונה, 4034388 (Provider), and the Customer identified by the applicable Marketplace order. It applies automatically when Provider processes Customer Personal Data on the Customer's behalf in providing the App; a separately completed customer-name placeholder is not a prerequisite. Any separately executed version must identify the same parties and applicable order. Provider's postal and legal-notice address is the same address specified in the Terms.

Customer Personal Data means personal data submitted, accessed or generated for the Customer through the App or support provided on its behalf. Provider acts as processor when Customer is controller, or subprocessor when Customer acts for an authorized controller. Processing for Provider's independent business-administration purposes is described separately in the Privacy Policy and is not reclassified as processor activity merely by including this DPA.

Applicable Data Protection Law means data-protection law applicable to the relevant party and processing. Controller, processor, personal data and personal data breach have the applicable statutory meanings.

2. Instructions and permitted purposes#

Provider will process Customer Personal Data only on documented instructions in the Agreement, authorized App operations and subsequently agreed written instructions, including regarding transfers. Provider will inform Customer if, in its opinion, an instruction infringes applicable data-protection law and may suspend the affected instruction while the parties resolve the issue.

If law requires other processing, Provider will inform Customer of the requirement before processing unless legally prohibited. Customer will ensure lawful instructions, required notices and authority, and will not instruct processing incompatible with the App's supported scope or platform terms. Provider's own mandatory duties are not transferred to Customer.

Provider will not sell Customer Personal Data, use it for advertising or AI training, or use it for unrelated purposes. Authorized personnel must have appropriate confidentiality obligations and access limited to their responsibilities.

3. Processing particulars#

App records do not intentionally retain names, email addresses, raw Jira responses, raw JQL or issue content. Temporary API processing and customer-supplied support correspondence are distinct. The masking-enabled build stores installation-specific references in supported account fields and membership keys. Forge secret storage separately holds the installation key and one original identifier per account needed for authorized Jira/App operations, temporary display, privacy reporting, export and erasure. Existing derived hashes may remain linkable. Pseudonymous account references are not anonymous, and this measure does not disapply this DPA or Applicable Data Protection Law where their conditions are met.

4. Security#

Provider will implement appropriate technical and organizational measures taking account of the processing, risks, available technology and implementation costs. The measures in Annex A are the baseline. Provider may update measures without materially reducing overall protection and will describe material changes where required. This does not warrant absolute security or transfer responsibility for the Provider's own controls to Atlassian.

5. Assistance and individual requests#

Taking account of the processing and information available, Provider will assist Customer with rights requests, security obligations, breach response, impact assessments and prior consultation where applicable. Requests received directly for Customer-controlled data will be referred or coordinated promptly; Provider will not independently disclose another person's or the entire installation's information to a requester without appropriate authority.

Identity and authority verification must be proportionate. Provider must not condition mandatory assistance on purchase of a renewed App license. Reasonable charges for extraordinary, customer-specific assistance may be agreed in advance where lawful; routine required assistance or urgent mandatory action must not be obstructed by unresolved fees.

6. Personal data breaches#

Provider will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notification will not wait for every fact or the full investigation to be complete. An unsupported suspicion alone is not represented as a confirmed breach.

As available, notice will describe the nature of the breach, affected data/subject categories and approximate numbers, likely consequences, containment/remediation and a contact point. Missing information may be supplied in phases without undue further delay. Provider will preserve appropriate evidence, investigate, mitigate and reasonably cooperate with Customer. Neither notification nor preliminary information constitutes an admission of liability. Customer's or Provider's mandatory regulatory duties remain unaffected. Business-day support targets do not extend breach-notification deadlines.

7. Subprocessors#

Customer generally authorizes the subprocessors in Annex B for the stated purposes. Provider will impose written data-protection obligations appropriate to their processing and no less protective in substance than those required by Applicable Data Protection Law. Provider remains responsible for subprocessors' performance as required by that law.

Provider will maintain a current list and notify Customer of proposed additions/replacements sufficiently in advance to allow a reasonable, protection-based objection. Provider must subscribe to relevant upstream notices and promptly pass on material changes; it must not promise a notice period longer than it can provide. On a reasonable objection, the parties will seek an appropriate alternative or safeguard. If unresolved before the relevant processing begins, they will address suspension or termination of the affected service and legally required return/deletion and billing adjustments. Urgent changes required by law or security will be explained with notice as soon as lawful/practicable.

A new external runtime, database, analytics, AI or notification processor is not authorized merely by silently updating a webpage. Applicable notice, instruction and transfer requirements must be satisfied before its processing.

8. Transfers#

Provider will not make a restricted transfer without a valid mechanism and required supplementary safeguards. Depending on the transfer, this may include an applicable adequacy decision, EU standard contractual clauses with the correct module/annexes, and the UK Addendum or IDTA where required. Provider will reasonably assist with the relevant transfer assessment and provide available safeguard information.

The Forge DPA applies to its own parties and processing; it does not automatically cover the Customer-to-Provider relationship or every support-data transfer. Annex B and any necessary transfer annex must identify the actual entities, locations, roles, competent authority and safeguards before covered processing begins. A required transfer instrument's mandatory precedence and individual rights prevail over contrary commercial language.

9. Return and deletion#

At the end of relevant processing, Provider will, at Customer's choice, return or delete Customer Personal Data and delete existing copies, unless law requires retention. An authorized JSON export can resolve stored references to original identifiers; it excludes the installation key and internal mapping/index records. History deletion while the installation remains in use retains the installation key and necessary identity control. Unused account mappings are removed in bounded passes after remaining references and pending privacy/history work are checked. These technical safeguards do not authorize retaining Customer Personal Data without a continuing permitted purpose or override the return/deletion obligations in this section.

The JSON export and history-deletion control provide supported self-service methods; Provider will assist with legally required requests outside their limits. Return format, secure delivery and completion must be agreed in a manner consistent with applicable law, rather than rejected solely because a UI feature is unavailable.

Customer should export and request app-level deletion before uninstall where practicable. Failure to do so is not a waiver. Provider will explain platform-controlled retention/recovery limitations, coordinate available steps and confirm the action taken. Legally retained copies must have a stated justification, limited access and no incompatible further use. Necessary restriction markers are used only to prevent prohibited re-collection and follow the platform lifecycle when the installation ends. Backups/platform remnants must remain protected and expire or be erased under the applicable documented lifecycle.

10. Information, audit and precedence#

Provider will make available information reasonably necessary to demonstrate compliance and allow/contribute to audits, including inspections, as required by Applicable Data Protection Law. Existing evidence, questionnaires and independent reports may be used first where sufficient. Reasonable notice, scope, confidentiality and protection of other customers may be agreed; they must not defeat mandatory audit rights or urgent regulatory requirements. Auditors must avoid unrelated data and unnecessary disruption. Extraordinary costs may be agreed where lawful, not used to block a required audit.

The DPA prevails on Customer Personal Data processing, subject to mandatory law and applicable transfer instruments. Contractual liability follows the Terms insofar as lawful; it does not restrict data-subject/regulator rights or mandatory transfer-instrument liability. Governing law and forum follow Section 11 of the Terms: the laws of the State of Israel and the competent courts in the Tel Aviv-Yafo district, subject to mandatory venue rules and laws that cannot be waived, except where a mandatory transfer instrument prescribes otherwise.

Annex A — technical and organizational measures#

• Forge-hosted compute and installation/environment-scoped storage; no browser-provided tenant selector.
• Live Jira ADMINISTER checks on App resolvers, including export and privacy requests; trusted license gating of paid mutations only.
• Read-only Jira configuration access; report:personal-data used for Atlassian privacy reporting.
• Restricted inputs, paginated exports, no partial file silently presented as a complete export, and no external export-file storage service.
• Installation-specific HMAC-SHA-256 references for supported stored account fields/keys; a random installation key and one original per account in separate Forge secret storage. Authorized operations may decode originals; existing derived hashes remain for compatibility. This is pseudonymization, not anonymization.
• Missing/mismatched identity keys or mappings fail closed; no automatic key replacement. Bounded reference-aware mapping cleanup preserves the installation key/control while required. Recovery must preserve the original key and compatible decoder; no independent backup or absolute recovery guarantee is made.
• Restricted operational logs, no raw API payload logging, controlled administrator access and confidentiality duties.
• Resumable privacy inventory/reporting/erasure, exact account/derived-reference matching, re-collection restrictions, and shared scan/maintenance coordination.
• Dependency/secret checks, controlled changes, vulnerability remediation and incident handling under the documented operating procedure.
• Security of support correspondence through the login-required Jira Service Management portal with customer isolation and configured Google Workspace controls; account settings and access require operational evidence.
• Return/deletion procedures, limited retained receipts and documented platform lifecycle.

The masking measure is enabled and qualified in Development; other existing installations require a compatible controlled upgrade. No representation is made that all installations have been converted. These measures describe the masking-enabled implementation. Internal qualification does not represent acceptance of every customer environment.

Annex B — providers and transfer completion#

The Privacy Policy describes provider locations and transfers. We ordinarily operate and access records from Israel; this is not an exclusive-country guarantee. Applicable transfer safeguards under Section 8 must cover the actual processing. Cloudflare Pages delivers the separate public static documentation website and processes delivery/security request metadata, potentially including visitor IP addresses. It receives no Jira records or App exports in this configuration and is not designated an App-data subprocessor solely by hosting public documentation. Any later Customer Personal Data processing on Customer instructions is subject to Section 7 and applicable transfer requirements.

Annex C — California service-provider terms, where applicable#

For personal information received from a Customer that is a business under the CCPA, Provider acts as service provider/contractor as applicable only for the specific business purposes in Section 3. Provider will not sell or share that information as those terms are defined in the CCPA; retain, use or disclose it outside those specified purposes or the direct business relationship except as permitted by law; or combine it with information from other persons or Provider's own interactions except where expressly permitted.

Provider will comply with applicable CCPA obligations, provide the required level of protection, notify Customer if it can no longer meet those obligations, and permit reasonable steps to assess compliance and stop/remediate unauthorized use. Provider will cooperate with applicable rights requests and legally required assessments/audits, and impose required terms on downstream providers. This annex does not assert that every customer or every independent Provider activity meets the statutory definition of a CCPA business.

Contacts: [email protected]; [email protected].