Axeri Labs Bt. — Security Policy
Last updated: 28 October 2026
This policy applies to every app published by Axeri Labs Bt. on the Atlassian Marketplace.
1. How our apps are built — and why that is the policy
All our apps are Atlassian Forge apps. They run on Atlassian's own infrastructure. We operate no servers, no databases, and no services of our own.
Three properties follow from that, and they are the strongest security controls we have:
- No outbound network calls. Our apps contact no address outside Atlassian. There is no analytics, no error reporting service, no content delivery network, and no subcontractor.
- Read-only. Our apps hold no write permission for Jira. They cannot create, change, or delete anything in your site.
- No elevated access. Every read is performed as the person looking at the screen. An app never sees more than that person is allowed to see, and two people can see different numbers in the same gadget.
These are not promises. Each one is enforced automatically on every build, and the build fails if it is violated:
| Automated check | What it enforces |
|---|---|
egress-check | no outbound network call anywhere in the source |
readonly-check | no write operation against Jira |
pii-check | no personal data in log output |
2. Reporting a security issue
Email support@axerilabs.com with "Security" in the subject line. These are read first.
Please include, as far as you can:
- which app and which version,
- what you did, step by step,
- what you expected and what happened instead,
- whether the Jira site is company-managed or team-managed.
Safe harbour. We will not pursue legal action against anyone who reports an issue in good faith, gives us a reasonable chance to fix it before disclosing it, and does not access, change, or delete data belonging to other people while testing.
3. How a report is handled
| Step | What happens | Target |
|---|---|---|
| Acknowledgement | We confirm we have read the report and say what happens next. | 2 working days. Within 24 hours, weekends included, for issues Atlassian classifies as critical. |
| Triage | We reproduce the issue, decide its severity, and identify the affected versions. | 5 working days |
| Fix | We correct the code, extend the automated test suite so the issue cannot return unnoticed, and release. | Depends on severity. We tell you our estimate during triage. |
| Disclosure | We inform affected customers through the Marketplace, and Atlassian through the partner channel when their rules require it. | With the fix |
An acknowledgement means we have read your report and told you what happens next. It does not mean the fix is ready; we do not promise a fix time before we understand the issue.
4. Vulnerability and patch management
Our own code. Fixes go through the same path as every other change: an automated test suite, the three checks listed in section 1, and a release. For Forge apps, minor updates reach every installation automatically, without the customer's administrator having to act.
Dependencies. Our apps depend only on Atlassian's own Forge packages. We add no third-party runtime libraries, so our exposure to dependency vulnerabilities is limited to what Atlassian ships. We track the Forge changelog and update when a release affects us.
The platform. The Forge runtime, the underlying infrastructure, and Jira itself are maintained and patched by Atlassian under their own security programme. We do not host or patch any part of it.
5. Security controls
Access control and authentication
- Jira data is read as the signed-in user, never with elevated application permissions. The app inherits that person's permissions exactly.
- Publishing access to the Atlassian Developer Console and the Marketplace partner account is protected by an Atlassian account with two-step verification enabled.
- Only one person has publishing access. There are no shared accounts and no standing third-party access.
Data protection
- Our apps store no customer data outside Atlassian, because they send no data outside Atlassian.
- The only thing stored is each gadget's own configuration — which board, filter, or field was selected. It is kept in Forge's app storage, on Atlassian's infrastructure, and it is removed when the app is uninstalled.
- Encryption in transit and at rest is provided by the Atlassian platform. We add no storage of our own that could weaken it.
- No personal data is stored. Where a report shows a person's name, it is read from Jira at the moment you look at it and is not retained.
Monitoring and logging
- Application logs are Forge's own and are visible only to us, through the Atlassian Developer Console. An automated check keeps personal data out of them.
- We run no separate monitoring infrastructure, because we operate no infrastructure of our own to monitor.
6. What we do not claim
We would rather state our limits than let a certification logo imply something untrue.
- Axeri Labs Bt. is a small company. We do not operate a 24/7 security operations team.
- We hold no SOC 2, ISO 27001, or equivalent certification.
- We do not commission scheduled third-party penetration tests.
- Physical security, network security, and platform hardening are Atlassian's, under their own programme. Our apps add no infrastructure that would need separate hardening.
7. Contact
support@axerilabs.com — written support, in English.
Axeri Labs Bt. Brassói utca 7. 2120 Dunakeszi Hungary