Security Overview

This document describes how Auditforge handles security. It is also designed to be reused, in part or in full, as answers to vendor security questionnaires from prospective customers.

Operator: Sathvic Kollu, Bangalore, India
Contact: security@auditforge.sathvickollu.com

Threat model in one paragraph

Auditforge is a Forge-hosted app that reads Jira issue data inside a customer's Atlassian tenant, sends those issue summaries to the Anthropic API (api.anthropic.com) along with a control description, receives a narrative draft, and stores it in Forge Storage. There is no Auditforge-operated infrastructure between the customer's Atlassian tenant and Anthropic. The threat model therefore reduces to: (1) Atlassian Forge's security posture, (2) Anthropic's API security, (3) Auditforge code defects that could leak data within the customer's own tenant, and (4) misuse of the Anthropic API key by malicious app users.

Architecture

Customer Atlassian Cloud tenant
   ┌────────────────────────────────────────────────┐
   │                                                │
   │   Jira data ────► Forge Function (Auditforge)  │
   │                          │                     │
   │                          │ HTTPS                │
   │                          ▼                     │
   │              api.anthropic.com  (TLS 1.3)       │
   │                          │                     │
   │                          ▼                     │
   │   Forge Storage  ◄── Narrative drafts          │
   │     (encrypted at rest)                        │
   │                                                │
   └────────────────────────────────────────────────┘

   No external Auditforge servers exist.

Data we receive, store, and transmit

The Operator (Sathvic Kollu) has no access to customer Forge Storage. Forge Storage is scoped per app and per customer; we cannot read it.

Encryption

• In transit: TLS 1.2 minimum, TLS 1.3 preferred. All outbound calls (to api.anthropic.com) and inbound calls (from Jira to the Forge function) are over HTTPS, enforced by Atlassian's Forge platform.
• At rest: Atlassian encrypts Forge Storage at rest using AES-256.

Authentication and authorization

• App authentication: managed by Atlassian Forge. The customer admin installs the app, which triggers an OAuth handshake granting the requested scopes.
• User authentication: Atlassian SSO. Auditforge has no separate login.
• API key for Anthropic: stored in Forge Storage, only accessible by the customer's installed app instance, not by any other workspace or by the Operator.

Permissions requested

The minimum scopes required:

We do not request write scopes to Jira or Confluence. We do not request user email at the workspace level. We do not request administrative scopes.

External data transfers

The only outbound connection from the Forge function is to https://api.anthropic.com/v1/messages. This is declared in the manifest and enforced by Forge's egress policy. The function cannot connect to any other external domain.

Anthropic, as a subprocessor, processes the payload to generate the narrative. Anthropic's commercial terms apply. By default, API requests are NOT used to train Anthropic's models. Customers can verify this in the Anthropic console.

Vendor compliance

We are honest about our individual-operator status. Customers requiring SOC 2 or ISO 27001 evidence from the vendor today should not adopt Auditforge until our certification completes. Atlassian and Anthropic's certifications apply to their portions of the stack.

Incident response

• We monitor support@auditforge.sathvickollu.com and security@auditforge.sathvickollu.com daily
• A security report or suspected breach will receive an acknowledgement within 4 hours during business days (IST), 24 hours otherwise
• Customers affected by a confirmed breach will be notified within 72 hours of confirmation
• A public post-mortem is published within 7 days for any incident affecting more than 5 customers

Vulnerability disclosure

Report security issues to security@auditforge.sathvickollu.com. We will:

• Acknowledge within 4 business hours
• Triage and respond with a fix timeline within 5 business days
• Credit the reporter publicly (with permission) once the issue is resolved
• Not pursue legal action against good-faith researchers

Bug bounty program: not yet, but we will set one up via HackerOne or similar in 2027.

Data deletion

• Per-narrative deletion: customer admins can delete individual narratives from the audit log view (coming in v0.3)
• Bulk deletion: uninstalling the app triggers Atlassian's 30-day retention then deletion
• Right to be forgotten: email security@auditforge.sathvickollu.com and we will work with Atlassian Support to expedite deletion

What Auditforge does NOT do

• We do not train models on customer data. We do not operate any model.
• We do not aggregate data across customers. Each Forge installation is fully isolated.
• We do not share customer data with marketing, analytics, or sales tools. There are no such tools wired into the app.
• We do not have remote access to customer environments. We cannot view your data.
• We do not store payment information. Atlassian handles billing.

Subprocessors

See the Privacy Policy for the current list. As of launch:

• Atlassian (hosting)
• Anthropic (AI)
• Hostinger / Cloudflare (marketing site only, no customer data)

We commit to 30 days notice before adding any new subprocessor.

Security questionnaire answers (cheat sheet)

For customer security questionnaires, copy these short answers:

• "Do you operate infrastructure that processes customer data?" No. The app runs entirely inside the customer's Atlassian tenant.
• "What encryption is used?" TLS 1.2+ in transit, AES-256 at rest, both managed by Atlassian Forge.
• "What scopes does the app request?" read:jira-user, read:jira-work, storage:app, external fetch to api.anthropic.com.
• "Is customer data used to train AI models?" No. Anthropic does not train on API data by default. We do not operate any AI model.
• "Do you have SOC 2?" In progress, Q1 2027 target. Atlassian and Anthropic both hold current SOC 2 Type II certifications.
• "Can you provide a Data Processing Agreement (DPA)?" Yes, a standard DPA is available on request. Email security@auditforge.sathvickollu.com.
• "What is the data residency option?" Forge data resides in the customer's Atlassian region (US, EU, AU). Anthropic API calls default to US; EU customers can configure Anthropic for EU residency where supported.

Updates to this document

Material updates will be communicated to active customers at least 30 days before they take effect.