Security policy
This policy explains how Poinciana Works LLC secures its apps and the infrastructure behind them, how we handle security incidents and vulnerabilities, and the controls we have in place.
- Platform
- Atlassian Forge, inside Atlassian's infrastructure
- Data sent outside Atlassian
- None
- Customer data we store
- None
- Report an issue
- support@poincianaworks.com, subject "Security"
1. How the apps run
Both apps are built on Atlassian Forge and run entirely on Atlassian's platform. We operate no servers, databases or third-party services of our own, and the apps make no connections to anything outside Atlassian. Stale Work reads work items and changes nothing; it stores only each gadget's settings, which Jira keeps on your own site. Bulk Watchers changes watchers only when a user confirms a preview, and stores nothing. Full details are in our privacy policy.
2. Security incident and issue handling
Reporting. Customers, researchers and Atlassian can report a security issue by emailing support@poincianaworks.com with "Security" in the subject line. We also receive reports through Atlassian's ecosystem support channel. Every report is acknowledged within 12 hours, any day.
Handling. We follow a written incident response plan based on Atlassian's guidance for Marketplace partners:
- Assess within 24 hours: confirm the issue, which app and versions are affected, and whether customer data could be exposed.
- Contain: stop the exposure first, by rolling back or deploying a fixed version, removing a permission, or disabling the affected feature. If an account may be compromised, we change its password, revoke tokens and sessions, and confirm two-step verification.
- Fix and recover: fix the root cause, test it, deploy it, and confirm the fix with the reporter.
- Review: within one week, record the timeline, cause, fix and the changes made to prevent it happening again.
Communicating with affected users. We notify Atlassian through its ecosystem support channel within the timeframes in its incident guidelines. We notify affected customers directly, explaining what happened, what was affected, and what, if anything, they need to do. Please give us a reasonable time to fix an issue before disclosing it publicly.
3. Vulnerability management
- Reporting: as above, to support@poincianaworks.com with "Security" in the subject line. Please include the app, steps to reproduce and the expected impact.
- Triage: we confirm and assess every report within 24 hours and rate its severity using the CVSS-based approach in Atlassian's Security Bug Fix Policy.
- Remediation: confirmed vulnerabilities are fixed within the timeframes that policy sets for each severity level.
- Patching: fixes are deployed to production on Forge. Updates that do not change an app's permissions reach every installation automatically, without customer action. If a fix needs new permissions, we tell customers how to approve the update.
- Prevention: before every release we run Atlassian's Forge linter and a dependency vulnerability scan. Dependencies with high or critical vulnerabilities are updated before release.
4. Security controls and safeguards
Access control and authentication
- Two-step verification is required on every company account, including our Atlassian developer and Marketplace accounts. Strong, unique passwords are enforced.
- Access to every account and developer space is reviewed each quarter, and anything not needed is removed. API tokens are created only when needed and revoked afterwards.
- The apps act as the signed-in Jira user wherever possible, so they can only see and change what that person is already allowed to in Jira. Each app requests the fewest Jira permissions it needs.
Data protection
- The apps store no customer work data. Stale Work's gadget settings are stored by Jira on your own site.
- All data the apps handle stays inside Atlassian's infrastructure, which encrypts data in transit and at rest.
- No customer data is logged, copied, sold or shared, and the apps use no cookies, analytics or tracking.
- Source code backups are kept in encrypted storage. No secrets or credentials are stored in source code.
Monitoring, logging and infrastructure security
- Hosting, network security and tenant isolation are provided by Atlassian under the Forge shared responsibility model. We run no infrastructure of our own to secure.
- We monitor app errors and alerts in Atlassian's Forge developer console, and security alerts from our account providers.
- The apps never write customer data or secrets to logs.
- Sign-in and administrator audit logs for company accounts are kept by Google Workspace and Atlassian, and only the owner can view them.
- Development devices use full-disk encryption, endpoint protection and automatic security updates.
- Production deployments are made manually by the owner, after testing on a separate development site.
- AI coding tools used during development work on source code only and never have access to customer data.
5. Certifications
Poinciana Works LLC does not currently hold SOC 2 or ISO 27001 certification. Our apps inherit the controls of Atlassian's Forge platform, described on Atlassian's Trust Center.
6. Changes to this policy
We review this policy at least once a year and whenever our apps or services change. The date above shows when it last changed.
Contact
Poinciana Works LLC
support@poincianaworks.com