User Access Review for Jira — Privacy Policy

Last updated: 14 August 2026. Applies to the User Access Review for Jira Cloud app.

The short version

User Access Review runs entirely on Atlassian's Forge platform. It has no external server and no egress permission in its manifest, so your data never leaves Atlassian's infrastructure. The app is read-only and stores nothing: every table is rebuilt from Jira each time you open the page.

What data the app accesses

Within your Jira Cloud site only, and only for the project whose page you are viewing:

• read:jira-work — to read the project context and the project's role assignments (/rest/api/3/project/{key}/role).
• read:jira-user — to resolve the users and groups listed in those roles, so the table can show a display name and a group label instead of a bare identifier.
• storage:app — to keep the dated access snapshots described below. The app no longer requests manage:jira-configuration: it stopped reading Jira's own audit log (/rest/api/3/auditing/record) precisely so that it would not need that administrator-level scope.

The data touched is therefore: project role names and the users and groups that hold access to a project (Atlassian account IDs, display names, group names), together with how that access is granted — through a role, a group or a direct grant.

Requests to Jira are made as the app rather than as the viewer, so the page can show the complete role and audit picture instead of a partial one. Precisely because of that, the app checks your own permissions before it makes those requests: the permissions table requires the Administer Projects permission on the project you are viewing, and the audit report requires the site-wide Administer Jira permission. That check is made against Jira with your own credentials, and it fails closed — if it cannot be completed, access is refused rather than granted.

Where data is stored and processed

• The app stores dated access snapshots. To answer “who had access in March” it records, per project and per day, who can reach that project and how — Atlassian account ID, display name or group name, and whether that route carries browse and administer rights. These snapshots are kept in Forge storage (Atlassian's own key-value store, scoped to your installation) under the storage:app scope. A snapshot is taken by a scheduled job that runs once a day, and when somebody opens the page. Two snapshots on the same day replace each other, so a day is the smallest unit of this history.
• Nothing else is persisted. The app writes no Jira entity properties, issue properties or custom field values, and holds no external database. The tables you see on screen are rebuilt from Jira each time you open the page; only the daily snapshot is written.
• History starts at installation. A period from before the app was installed cannot be reconstructed.
• All processing happens inside Atlassian Forge. The manifest declares no external permissions, so the platform blocks any outbound network call by design.
• Data residency follows your Atlassian site's own configuration.

What the app does not do

• It does not sell, share, or transfer your data to anyone.
• It does not use analytics, telemetry or tracking of any kind.
• It does not send data to any third-party service — technically it cannot.
• It does not change anything in Jira: no permissions are granted, revoked or edited.
• The CSV export is built in the page and shown as copyable text; it is not uploaded anywhere.

Data retention and deletion

Access snapshots are retained for 400 days, and older ones are removed automatically whenever a new snapshot is written. That window is deliberately just over a year: the audit periods this app is built for (ISO 27001, SOC 2) run twelve months, while Jira's own audit log stops at 180 days. Uninstalling the app immediately ends its access to your Jira site, and its Forge storage is discarded with the installation; reinstalling starts a fresh history rather than restoring the old one. Nothing is written into Jira itself, so uninstalling leaves no residue there.

Contact

Questions about this policy: info@kyc-checks.nl.