Security

Last updated: October 26, 2026

This page describes the security practices for Lefryx Checklists for Jira (Templates, Automation & DoD) ("the app"), provided by Lefryx. What data the app collects and how it is used is described in the Privacy Policy.

Platform

The app is built on Atlassian Forge and runs on Atlassian-hosted compute and storage. It makes no outbound network calls to services outside Atlassian's infrastructure. We operate no servers, databases, or other infrastructure of our own.

Data handling

• All data the app stores is held in Atlassian Forge storage for your Atlassian cloud site. Data residency for this storage is provided by Atlassian as described in its documentation for Forge apps.
• We keep no copy of your data. When the app is uninstalled, its data is deleted by Atlassian in line with the Forge data retention policy.
• The app does not ask for or store passwords, API tokens, or other credentials.

Encryption

Data is encrypted in transit and at rest by Atlassian as part of the Forge platform.

Access control

• The app requests only the permissions it needs: storage:app, read:jira-user, read:jira-work, and write:jira-work. Why each one is needed is listed in the Privacy Policy.
• Requests a user makes through the app run with that user's own Jira permissions.
• The workflow validators run in Jira during a transition, without a user session. They use the app's own access only to look up the issue being transitioned, so that they can check its checklists.

Logging

The app writes technical error logs, such as issue IDs and error messages, to Atlassian's Forge logging service. The logs contain no checklist content and no credentials.

Vulnerability management

• The app's third-party dependencies are checked for known vulnerabilities with automated tools, and the app is also scanned by Atlassian as part of the Marketplace security programme.
• Reported vulnerabilities are fixed within the timelines of Atlassian's Marketplace Security Bug Fix Policy.

Reporting a security issue

To report a security issue, write to support@lefryx.com. We reply within 1 business day.

Incident response

If we become aware of a security incident or a critical vulnerability affecting the app, we will notify affected customers and Atlassian without undue delay, following Atlassian's guidelines for Marketplace partners.

Certifications

The app holds no security certifications of its own. It runs on Atlassian's Forge platform; Atlassian's compliance programmes are described in the Atlassian Trust Center.