Security and privacy

Last updated 2026-11-09

Runs on Atlassian. The app is built on Atlassian Forge and runs entirely inside Atlassian's infrastructure. It declares no external network access. Nothing is sent to us or to any third party.
Minimal storage (since version 4.0). The app keeps one record per site in Atlassian's Forge hosted storage: the team directory, a list of team ids and team display names. It is used only to translate names in teamIn() into team ids, because JQL functions run without a signed-in user and so do not call Atlassian APIs. No issue content, no descriptions, no members and no personal data are stored. The record stays inside Atlassian's infrastructure, follows your site's data residency, is refreshed hourly and is deleted by Atlassian when the app is uninstalled.
Permissions respected. Issue data is read as the person using the app, so results never exceed what that person can already see in Jira. teamIn() only returns a Team field condition; Jira then applies the searcher's own permissions to the results.
Scopes requested and why

Scope	Used for
`read:jira-work`	Read issues and fields for the gadget, panel and JQL functions
`read:jira-user`	Resolve the current viewer for "you are a member"
`view:team:teams`	List Atlassian Teams (name, description, size)
`view:membership:teams`	Determine whether the viewer belongs to a team
`storage:app`	Keep the team directory (team ids and names) used by `teamIn()`

No product write scopes. The app cannot modify issues, fields, teams or settings. storage:app covers only the app's own storage record described above.
Data residency. Forge apps follow the data residency of your Atlassian site.
Vulnerability reports: email the support address in Support with "security" in the subject.

Was this page helpful? Email support@mortiseapps.com.