Data Handling And Security

# Data Handling and Security

SyncBridge is built on Atlassian Forge — a fully serverless, Atlassian-hosted runtime. No data flows through external servers operated by Optimizory. All processing happens within Atlassian's infrastructure.

What Data is Stored and Where

Data Storage Location Encryption
Connection metadata (name, instance URL, status) Forge KVS (storage:app) At rest (Atlassian-managed)
OAuth credentials (Client ID, Client Secret, access token) Forge KVS Secrets (kvs.setSecret) Encrypted at rest; returned only to the app's own backend
Binding configuration (project, entity mappings, field mappings) Forge KVS At rest
Issue associations (linked SF record IDs, cached field values) Jira Issue Properties (write:app-data:jira) At rest on Atlassian-managed Jira storage

What Data is Never Stored

  • Salesforce record contents are never stored beyond the cached field values explicitly set up via Display Fields configuration. The cache lives in Jira issue properties and is refreshed only when a user or trigger performs a Pull.
  • Jira issue content is fetched from Jira's API at sync time and is never written to external storage.
  • No data is sent to Optimizory's servers. There are no analytics calls, no telemetry, and no third-party destinations.

Credential Security

The Salesforce Client ID and Client Secret are stored using Forge's encrypted secret storage (kvs.setSecret / kvs.getSecret). These values are:

  • Never returned to the frontend (the admin page receives only the connection status, not credentials)
  • Never logged in plain text
  • Used only on the backend to request OAuth tokens from Salesforce

Access tokens are refreshed automatically when they expire. If a refresh fails, the connection status changes to Expired and must be manually reconnected by a Jira admin.

Network Access

The connector makes outbound HTTPS requests only to Salesforce domains declared in the app's manifest:

  • *.salesforce.com
  • *.my.salesforce.com
  • *.force.com
  • *.lightning.force.com
  • *.sandbox.my.salesforce.com

No other outbound domains are permitted.

Data Residency

Forge KVS data is stored in the same region as your Atlassian Cloud site. SyncBridge does not perform cross-region replication or store data outside the Atlassian-managed region for your site.