/
Security Policy — Dependency Manager for Jira Cloud

Security Policy — Dependency Manager for Jira Cloud

This Security Policy describes how Dependency Manager for Jira Cloud ("the app"), published by Divim, Inc., is secured and operated, and the safeguards that protect customer data. It applies to all Atlassian Marketplace cloud installations of the app.

Last reviewed: 2026-06-15

1. Atlassian Marketplace trust programs

  • Runs on Atlassian. The app is an auto-verified Atlassian Forge app and carries Atlassian's Runs on Atlassian designation — meaning it runs entirely on Atlassian-operated infrastructure with no data egress to Divim or any third party.

  • Platform certifications inherited. Because the app runs on Atlassian Forge, it inherits the security and compliance posture of the Atlassian Cloud platform, including Atlassian's SOC 2 Type II and ISO/IEC 27001.

2. Platform and hosting

  • The app runs entirely on Atlassian Forge — a serverless platform operated by Atlassian. There is no Divim-operated server, no self-hosted infrastructure, and no third-party hosting.

  • All compute and persistent storage occur within Atlassian's cloud (Forge runtime and Forge storage), inheriting Atlassian's tenant isolation and data-residency controls.

3. Architecture and data egress

  • No external egress. The app makes no outbound network calls outside Atlassian's cloud. There is no analytics SDK, no third-party error reporter, and no vendor-side copy of your dependency data.

  • Reads native Jira links. Dependency relationships are read from native Jira issue links (for example "blocks" / "is blocked by") and processed in-memory to build the dependency graph and critical path.

  • Operational data stays in Forge. Configuration, layout state, and pending-change queues are stored in Forge-hosted storage; a limited set of UI preferences is held in the browser's local storage.

4. Authentication and authorization

  • The app authenticates through Forge's managed app identity; no OAuth client secrets, refresh tokens, or API keys are held by Divim.

  • It requests least-privilege Jira scopes — only those needed to read project, version, issue, and issue-link data and to create or update the issue links used for dependency mapping.

  • Jira's permission model is respected; the app cannot expose data a user is not already permitted to see.

5. Encryption

  • In transit: all communication uses HTTPS / TLS, terminated by Atlassian.

  • At rest: Forge storage encrypts data at rest, managed by Atlassian.

6. Data handling

The app processes Jira data — projects, fix versions, issues, issue links, statuses, and assignees — to build the dependency graph, calculate the critical path, detect dependency cycles, and surface cross-release blockers. Data is used only to deliver app functionality and is never sold. Full detail is in the Privacy Policy.

7. Software development lifecycle

  • Source is maintained in a private repository with branch protection; changes land through reviewed pull requests.

  • Input validation and type checks are applied in backend paths; Jira API calls use safe, scoped, parameter-encoded requests.

  • Dependencies are monitored against published security advisories; only authorized maintainers can publish to the production Forge environment.

8. Vulnerability disclosure

  • Report suspected vulnerabilities to support@divim.io with the subject "Security Vulnerability Report — Dependency Manager".

  • Please do not publicly disclose a vulnerability before a fix is available.

  • We acknowledge reports within 5 business days and aim to remediate verified high-severity issues promptly.

9. Incident response

In the event of a confirmed security incident affecting the app, Divim will triage, contain, and remediate the issue, notify affected customers via the published support contact where appropriate, and coordinate with Atlassian where the incident touches Atlassian-operated infrastructure.

10. Customer responsibilities

  • Maintain appropriate Jira user and administrator permissions; the app respects Jira's permission model but cannot compensate for excessive permissions granted by the customer.

  • Review the Jira scopes requested at install and upgrade.

  • Keep the contact details on the Atlassian site current so Divim can reach you with security notices.

11. Contact

This policy is reviewed at least annually and updated as the app evolves. Trust-program participation is verified on the Atlassian Marketplace listing.