Security Overview

Architecture

• Atlassian Forge app for Jira Cloud with Custom UI and Forge resolver functions.
• Jira is required; Confluence is optional for publishing.
• No QTI Labs-operated StatusDeck customer-data backend/database.
• No Firebase in the StatusDeck application data path.
• PDF and PowerPoint generation occurs in the browser before download or explicit Confluence upload.

Access and permission controls

• Jira reporting requests operate with authorised Atlassian user context.
• The current manifest requests Jira read scopes rather than Jira write scopes.
• Confluence write scopes are used for explicit user-initiated publication.
• Confluence space/page access remains subject to Atlassian permissions for the current user.

Storage protection

Forge-hosted storage encryption and platform isolation are provided by Atlassian. StatusDeck limits report-cache lifetime and uses Forge KVS for small settings, commentary, schedule, publication and fair-use records. Jira/Confluence remain the customer systems of record.

Operational controls

• Restricted production access for authorised QTI Labs personnel.
• Multi-factor authentication on key development/Atlassian accounts.
• Source-control and dependency review practices.
• forge lint and regression validation before controlled releases.
• Manifest-scope and external-egress review when relevant code changes.

Logging

StatusDeck uses structured operational logging in Atlassian Forge for application events and diagnostics. Logs are not used for advertising or behavioural profiling.

Shared responsibility

Customers are responsible for Jira/Confluence permissions, endpoint security and the handling/sharing/deletion of downloaded or Confluence-published reports.

Vulnerability reporting

Report suspected vulnerabilities to support@qtilabs.com. Avoid including unnecessary sensitive customer data. See the Vulnerability Disclosure Policy.