License Radar for Jira — Security

1. Scope

This policy describes the security boundary for License Radar for Jira Cloud, a read-only Jira application operated through Atlassian Forge.

2. Read-only security boundary

License Radar reads supported Jira users, application-role access, observed group membership and bounded issue-update signals. It does not remove or suspend users, change groups, revoke product access, edit permissions, modify Jira configuration or change billing.

3. Platform and tenant isolation

The app runs in Atlassian Forge and uses Forge Storage within the installation environment. The authenticated Forge and Jira installation context is the authority for tenant identity; browser-supplied identifiers are not trusted as an authorisation boundary. Resolver actions enforce Jira site-administrator access as well as the UI visibility rule.

4. Permissions

Production requests are limited to the scopes required for the documented read-only job:

• read:jira-user — read supported site users and their application-role information.
• read:jira-work — read the bounded issue fields used for observable activity.
• report:personal-data — support Atlassian's personal-data reporting workflow.
• storage:app — keep tenant-isolated configuration, scan results and review records.

The production version has no configured external data egress or analytics service. It does not use a remote customer-data database, hidden service account or customer credentials.

5. Data minimisation

The app requests only the Jira fields needed for access and activity review. It does not collect passwords, API keys, personal access tokens, issue descriptions, comments, attachments or unrelated Jira content. See the privacy policyfor the full data description.

6. Reliability and limitations

Jira API errors, rate limits and incomplete activity data are surfaced as unavailable, partial or failed analysis states. The product does not turn a failed activity request into a claim that users have no activity. Estimates and activity signals depend on the data exposed by Atlassian and do not represent an official Atlassian invoice or login record.

7. Vulnerability disclosure

Report a suspected security issue privately using the support formwith category Security, or email support@narrowforge.comwith “Security – License Radar” in the subject. Include a concise description, reproduction steps, the affected feature and the expected security impact. Do not include credentials, tokens or unnecessary personal data, and do not publicly disclose the issue before review.

8. Incident handling

Reports are triaged and investigated. Where appropriate, the provider works to contain the issue, correct the affected behaviour and communicate material developments to affected customers. This policy does not promise a fixed response time.

9. Certifications and contact

License Radar does not currently claim SOC 2, ISO 27001 or another formal security certification. If that changes, the scope and effective date will be stated here. For security questions, contact support@narrowforge.com.

Related: Terms of service · Privacy policy · Customer support

Last updated: 2026-09-08.