Privacy Policy

Effective date: 14 November 2026 | Revised: 14 November 2026

Provider, scope and roles#

Shai Shmuel Laish, an individual operating at אהבת אדם 77, דירה 2, כפר יונה, 4034388 (Guardian, we, us), provides Config Health Guardian for Jira. Contact [email protected] for privacy questions, rights requests or complaints. Postal correspondence and legal notices may be sent to the same address; legal notices may also be sent to [email protected].

This notice covers the App, associated business communications and the public documentation website. The App performs read-only configuration checks and provides administrator guidance; it does not modify Jira or automatically repair findings.

For personal data processed through the App on customer instructions, we act as processor or subprocessor as applicable, under the DPA. The customer or its client determines the purposes of that processing. For business contact, correspondence and administrative information whose purposes and means we determine, we act as controller. Atlassian, Google and Cloudflare may separately process information for their own purposes under their applicable notices.

App information and sources#

Information comes from authorized Jira/Atlassian APIs, administrator actions and platform license/operational context. Stored information can include:

• Rule/schedule settings, capability choices, coverage and operational state.
• Scan identifiers, timestamps, status, metrics and bounded collector continuation state.
• Normalized project, filter, component, role, permission, board, workflow and field metadata, identifiers and relationships.
• Account identifiers for active or inactive owners, leads and direct role members, activity booleans, and USER permission-grant account references needed to manage the privacy lifecycle of linked evidence.
• Findings/evidence, historical comparisons, suppressions, remediation state and relevant administrator account identifiers.
• Privacy-reporting account references, observation/report times, pending erasure state and minimal hashed restriction markers to prevent prohibited re-collection.

Identifiers and linkable hashes can be personal data; we do not call them anonymous. Inactivity does not establish that a person left an employer.

The App does not intentionally persist email addresses, display names, raw Jira API payloads, raw JQL, Jira/API authentication tokens or issue content in customer-data records. API responses and display names may be processed temporarily to evaluate configuration or render an authorized response. Processing is distinct from storage. These App-storage limits do not apply to information a person sends in a business/support message.

Account-identifier masking#

The masking-enabled build replaces original account identifiers in supported stored ownership, membership, subject and administrator-actor fields and membership keys with stable installation-specific references. A random installation key and one original account identifier per account are held separately in Forge secret storage. Original identifiers are resolved on the server only as needed for authorized App/Jira operations, temporary display, privacy reporting, export and erasure. This does not add persistent name or email profiles.

This is pseudonymization, not anonymization. Existing derived fingerprints, notification/read-state hashes and privacy-restriction markers remain for compatibility and may be linkable. Authorized display/export responses may contain original identifiers. Masking does not remove provider-managed IP/request logs or backups, or any applicable data-protection duty. Missing or inconsistent keys/mappings block affected operations rather than silently creating a replacement key.

Masking has been enabled and qualified in Development. Other existing installations require a compatible, separately controlled upgrade; this notice does not represent that every installation has been converted.

Scan notifications#

When enabled by a Jira administrator, Guardian stores scan notification events, finding references, subject privacy mappings, per-administrator read/archive state, delivery claims and transition records in Forge storage. Channel settings apply to the installation; reading and archiving remain personal to each administrator. Notifications can appear inside Guardian and, when separately enabled and supported by Jira, as flags on other Jira pages. There is no email delivery service in this version.

Realtime messages carry an opaque refresh hint rather than finding evidence, unread counts or account identifiers. Notification events, receipts and inactive recipient records enter bounded cleanup after 90 days. Active-finding transition records can remain while needed to prevent duplicate notifications. Notification records are covered by export, subject erasure and history deletion; deleting history preserves channel preferences.

Business communications and website#

When you contact us, we process your contact details, organization, message, relevant identifiers and attachments to handle the request. Please provide sanitized evidence, not passwords, tokens, full Jira exports or unnecessary personal information. If an export is required for a particular request, we will agree an appropriate method and scope first.

Our separate Jira Service Management support portal processes support contacts, requests, replies and necessary attachments through Atlassian. Google Workspace processes business email, correspondence, files and calendar records. Both are separate from the Forge runtime. Marketplace contact/order/payment information actually provided to us is used for administration; payment-card processing by Atlassian is not an App feature.

The App uses no advertising/analytics cookies and sends no customer data to an AI service. Public website hosting, access logs, forms and any non-essential tracking must be assessed and disclosed before introduction. Absence of advertising cookies does not mean a website processes no personal information. The service is intended for business/professional administration and is not directed to children.

Public documentation website#

The public documentation website uses Cloudflare Pages to deliver static pages and assets. Cloudflare processes visitor interactions needed to deliver and protect the website; this can include IP addresses, traffic-routing data and system configuration information. Its network operates internationally, so this website does not carry an EU-only processing commitment.

The website includes no contact form, optional Web Analytics beacon, advertising tracker or website login. Documentation search runs in the browser using the site's own search index. Following a support-portal or email link opens the separately described support or email service. These choices do not eliminate Cloudflare's delivery and security processing.

See Cloudflare's Privacy Policy and Data Processing Addendum for provider information.

Purposes and legal bases#

App processing supports scans, findings, coverage, history, licensing, security, reliability, documented instructions, return/deletion and privacy reporting. The customer is responsible for its lawful basis, notices and authority; we also have applicable processor obligations.

Where we act as controller and a lawful-basis framework applies, we rely as appropriate on legitimate interests in responding to business contacts, operating/protecting the service, administering relationships and establishing or defending claims; contractual necessity where the individual is personally party to the relevant contract; and specific legal obligations. We assess legitimate interests against individual rights. Consent is used only where required or appropriate to the optional activity; withdrawal does not affect earlier lawful processing.

We do not sell personal information, use it for behavioral advertising or train AI models on customer data. Guardian does not itself make employment decisions or solely automated decisions having legal or similarly significant effects.

Recipients, locations and transfers#

The current App runs in Atlassian Forge without an external runtime, database, analytics or outbound-notification service. Atlassian supplies compute, storage, identity, logging and related services. Its privacy reporting API receives account identifiers and observation timestamps, not findings or issue content. JSON export returns records through the authenticated administrator's browser to their device; subsequent handling is outside App storage.

Support-portal communications are processed in Atlassian Jira Service Management; business email and related records are processed in Google Workspace. Authorized personnel, advisers and providers may receive necessary information subject to appropriate duties. Disclosure may also occur when lawfully required, to protect rights/security or during a lawful business transfer with appropriate safeguards.

The provider entities identified for these services are Atlassian Pty Ltd for Forge and Jira Service Management, and Google Cloud EMEA Limited for our Google Workspace Business Starter account. Atlassian's Forge DPA names Atlassian Pty Ltd; Google's entity is corroborated by our Workspace billing correspondence and its published contracting-entity table. These entities and their applicable affiliates/subprocessors provide the services; their own account, Marketplace and platform processing can have separate roles under their applicable terms and notices.

Forge residency concerns eligible in-scope data and supported configurations. Hosted storage follows the host product's residency configuration; compute can run elsewhere. It does not mean all logs, administration, correspondence and remote access occur in the Jira site's region. Our Workspace Business Starter edition does not include a configurable data-region policy. We ordinarily operate and access App/support/business records from Israel. This does not guarantee that every access or provider operation occurs only in Israel. Processing can occur where relevant providers and personnel operate. See Atlassian subprocessors, Forge DPA, Forge residency and Google Workspace subprocessors.

Cloudflare is the selected provider for the public static documentation website, separately from the Forge runtime. Website delivery/security metadata can include visitor IP addresses and request/routing information. Cloudflare operates an international network; no EU-only processing promise is made. See Cloudflare Privacy Policy and Cloudflare DPA. Selecting this provider does not authorize sending Jira records or App exports to the website.

Provider-wide disclosures reviewed on 4 October 2026 list possible Jira/JSM hosting in Australia, Canada, Germany, India, Ireland, Japan, Singapore, South Korea, Sweden, Switzerland, the United Kingdom and the United States, depending on the service and residency selection. They also disclose possible Forge and Jira/JSM infrastructure or support processing in Bulgaria, Poland, Romania and the United States. Google's disclosures include possible data-centre operations in the United States and technical-support or security-review processing in Australia, Bulgaria, Canada, India, Israel, Japan, Malaysia, Mexico, the Philippines, Romania, Switzerland and the United States. These are disclosed possibilities across the providers' services, not verified storage countries or access events for every Guardian installation or our accounts. The linked provider registers describe the relevant suppliers, purposes, conditions and full lists.

Where required, transfers must use applicable adequacy decisions, standard contractual clauses with necessary safeguards, a UK transfer instrument or another valid mechanism covering the actual parties and transfer. An upstream provider agreement does not automatically cover every transfer in the chain. Contact us for applicable safeguard information.

Retention#

Eligible resolved findings enter cleanup after 90 days from resolution; eligible terminal scans and associated assets enter cleanup after 90 days from completion. Drift history uses the applicable update timestamp. Scheduled cleanup is batched; eligibility is not a guarantee of physical erasure at exactly 90 days. Current/previous complete baselines and active findings can remain while needed for current behavior. Operators investigate cleanup failures and review data retained without an active purpose.

Event leases have a four-day lifecycle; scan leases are short-lived and renewable. Privacy maintenance inventories records and periodically reports retained account information to Atlassian. Reporting and pending erasure references remain as needed for this work. In the masking-enabled build, account mappings are removed in bounded mark/verify/sweep passes after remaining references and pending privacy/history work are checked. The installation key and necessary identity control are retained while the installation continues to use that identity scheme. This is not permission to retain original account mappings without a continuing purpose or contrary to an applicable erasure obligation. Hashed restriction markers remain while needed to prevent prohibited re-collection in the installed App; these are pseudonymous safeguards, not anonymous records, and follow the platform lifecycle on uninstall.

Our retention schedule for ordinary closed support correspondence is 24 months after the last substantive interaction, followed by deletion or a documented limited extension for unresolved obligations or disputes. Privacy-request and complaint evidence is limited to a minimal decision/audit record, normally retained for 36 months after closure; unnecessary request exports/attachments are deleted within 30 days after fulfilment/closure. Financial/legal records can require a different prescribed period. These business-record periods are administered through our correspondence procedures, not automated App features.

Our application logging uses restricted operational fields. Atlassian controls platform-log retention and its own operational records; we do not promise one retention period for every Atlassian service.

Export, deletion and account changes#

An authorized Jira administrator can select Download Guardian data (JSON) in Settings. The export includes stored customer records and, where present, decoded original account identifiers; storage masking does not make the downloaded file anonymous. It excludes temporary checkpoints, coordination leases and internal secrets, including the installation key and internal mapping/index records. It is not a Jira backup or restore format. It reads pages over an interval rather than an atomic snapshot. The current browser export has a 256 MiB content limit; larger returns require assistance. Failure does not silently produce a purportedly complete partial file.

Delete Guardian history removes supported scan history, findings/evidence, assets, relationships, suppressions, remediation state, baselines and associated operational rows in background batches. Rule/schedule settings, schema/capability configuration, a limited operation receipt and necessary privacy-restriction markers can remain. The masking-enabled build also retains its installation key and necessary identity control; unused account mappings are removed through bounded reference checks and cleanup. The receipt contains operation/status information, times and counts. History deletion does not alter Jira, cancel billing or disable future scans; enabled scans may collect data again.

Atlassian privacy signals and authorized individual erasure requests are handled separately. Subject-specific records and linked evidence can be removed; an administrator actor reference can be replaced while retaining the non-identifying decision where appropriate. Updated account data may be deleted and later collected afresh. Evidence removal invalidates comparison/coverage state and is not represented as a newly verified healthy configuration.

Use App-level deletion before uninstall where practicable. The current Forge storage reference describes 28-day hosted-data retention after uninstall, a 21-day recovery-request window and no automatic restoration on reinstall. Atlassian controls that process. Contact us if deletion fails, uninstall already occurred or assistance is needed. We do not promise instant physical erasure, and uninstalling first does not waive applicable rights.

Security, rights and complaints#

App UI resolvers require a current Jira ADMINISTER permission check. This concerns the App interface; authorized platform operations and business support are separate access paths. We use installation-scoped storage, bounded inputs and restricted logs as described in Security and Data. No service promises absolute security.

Depending on applicable law, rights may include information, access, correction, erasure, restriction, objection, portability, withdrawal of consent where relevant and complaint to an authority, subject to applicable conditions/exceptions. For organizational data, normally contact the organization first; we assist under the DPA. For our own controller processing, contact us directly. We verify authority proportionately and respond or coordinate within applicable deadlines. We do not request unnecessary identity documents. A full installation export must not be disclosed to an individual merely because it includes their data.

To complain, email [email protected] with the concern and a safe reply address. We acknowledge, investigate and explain the outcome, with progress information as appropriate. Where the UK statutory procedure applies, acknowledgment is within 30 days, without limiting a shorter applicable obligation. Individuals can also contact the competent authority, including the UK ICO or relevant EEA authority where applicable.

Changes#

Updates will be dated, with notice of material changes through an appropriate channel where required. A changed notice alone does not authorize incompatible processing or replace consent, documented instructions or other required steps.