Security

Architecture

CapRadar is built entirely on Atlassian Forge and declares no remotes and no external permissions, which is what Atlassian's Runs on Atlassian programme requires. The badge itself is awarded by Atlassian. The app has no servers of its own.

• User interface: Forge Custom UI with the Atlassian Design System and design tokens, in light and dark themes. It talks only to the app's own Forge functions and loads no external scripts, fonts or frames.
• Logic: Forge functions, scheduled triggers, product event triggers and queue consumers inside Atlassian.
• Storage: Forge SQL and the Forge key-value store (hosted storage), on Atlassian infrastructure.
• No remotes: no Forge Remote, no Connect, no web triggers, no backend operated by Radrly, and no public REST API.

Data flow

Inside the Atlassian cloud, CapRadar reads data from Jira Cloud through Forge platform APIs, computes its results in Forge functions, stores them in Forge hosted storage and shows them to authorised users inside the Atlassian product. Nothing leaves Atlassian: there is no connection to external servers, third-party APIs or external AI services.

CapRadar makes no writes to Jira content. All classifications and results are stored in CapRadar's own Forge storage.

Exports are generated for download by the signed-in user. Radrly receives no customer data.

Scopes

CapRadar declares all of its scopes in its Forge manifest. They are shown when you install the app and on the Marketplace listing. CapRadar is read only toward Jira.

• Jira work data: read access to work items, worklogs, spaces, work types and fields (granular read:* scopes or read:jira-work), used for ingest, rules and allocation.
• Users and groups: read:jira-user and read:group:jira, to resolve names at display time and map groups to roles.
• Storage: storage:app, Forge SQL and the Forge key-value store.
• Privacy: report:personal-data for Atlassian's personal data reporting.

CapRadar requests no write scopes for Jira content and declares no external hosts (permissions.external), no remotes and no web triggers.

No egress

CapRadar declares no external hosts and makes no outbound network calls. It uses no Forge Remote, no Connect, no web triggers and no fetch to external services. There are no Slack, Teams or email webhooks. The app sends no telemetry to Radrly or any third party.

Requests to Atlassian products use Forge's authenticated platform APIs. The app does not handle passwords, personal access tokens or shared secrets.

Data protection

• At rest: data is stored in Atlassian's Forge hosted storage, which Atlassian encrypts at rest.
• In transit: traffic between the browser, the Atlassian products and Forge uses TLS, managed by Atlassian.
• Data residency: app data follows the data residency location of your site. Radrly does not store data anywhere else.
• Minimisation: Worklog comments, work item summaries and descriptions, comments, attachments, email addresses and display names. Summaries used for R&D evidence are read with the caller's permissions when requested and not stored.
• Logs: the app logs operational status, job identifiers, counters and timings in the Forge developer console, without personal data or customer object names.

Access control

• Server-side checks first: every resolver and Rovo action checks the signed-in user's permissions and app role on the server before it reads any data as the app. Roles, space lists and flags sent by the browser are never trusted.
• Validated input: every payload is validated against a schema; Forge SQL queries use prepared statements only.
• No Radrly backend: the app has no code path that sends your data to Radrly, and Radrly operates no server that holds it.

Data lifecycle

• Install: the app asks for the scopes above and creates its storage.
• Use: Locked snapshots are kept while the app is installed. In the Advanced edition an administrator sets retention; many accounting regimes expect records to be kept for several years, so check your own requirements. Standard keeps audit trail detail beyond snapshots for 90 days.
• Uninstall: the Forge platform deletes the app's data according to Atlassian's policy for Forge hosted storage. Radrly keeps no copy.

See the Privacy Policy for details.

AI statement

CapRadar does not send data to any external AI service. The optional Rovo agent (Advanced) runs in Atlassian Rovo and reads CapRadar data through Forge actions inside Atlassian.

Compliance

CapRadar runs on Atlassian Forge. Atlassian's platform certifications cover Forge hosting; Radrly does not claim them as its own. For Atlassian's reports, see the Atlassian Trust Center. Radrly will complete the Marketplace security requirements that apply to the app.

Incident response

If Radrly becomes aware of a security incident affecting customer data in CapRadar, we will notify affected customers without undue delay, and in any event within 48 hours, with the information available to us, and keep them updated.

Secure development

• Automated checks before every production deployment: formatting, linting, type checking, unit tests and Forge lint.
• Dependency updates and vulnerability checks on production dependencies, and static code analysis.
• Secrets only in the build system; no secrets in the code.
• forge eligibility before every release, to keep Runs on Atlassian.

Reporting a vulnerability

Please email marcin@radrly.com with the subject [CapRadar security], a description, steps to reproduce and the impact you see. Do not include customer data. We will acknowledge your report within 2 business days and keep you informed until it is resolved. Please give us reasonable time to fix the issue before disclosing it.