Privacy & Data Handling

Connecting to Jira Cloud

You connect through Atlassian OAuth 2.0 (3LO). Authorization happens directly with Atlassian. We do not receive or store your Atlassian password.

Data accessed from Jira

During scans, CFGORA reads Jira configuration and administrative signals needed to assess site health — for example projects, workflows, custom fields, and audit records where available. This data is used only to produce health scores, findings, and investigations.

Data stored by CFGORA

When DATABASE_URL is configured, the application may store: connected Jira site metadata (name, URL, cloud ID); encrypted OAuth refresh tokens; saved scan summaries and finding snapshots; remediation plans; notification preferences; alerts; and scan schedule settings. All stored data is scoped to your connected Jira site.

Session cookies

HTTP-only session cookies hold short-lived access tokens and connection context while you use the application. These cookies are not accessible to client-side JavaScript.

How we use your data

Data is used to provide configuration health monitoring, saved scan history, trends, remediation tracking, and notifications. We do not use your Jira data for advertising or unrelated profiling.

We do not sell your data

We do not sell, rent, or trade your personal information or Jira data to third parties.

Revoking access

You can revoke CFGORA's access from your Atlassian account settings under connected apps. You can also disconnect or change sites within the application.

Data retention

TODO: Define formal data retention periods and deletion procedures for production deployment.

Legal entity

TODO: Add registered company name, address, and privacy contact details before public launch.

Product independence

CFGORA is an independent product and is not affiliated with or endorsed by Atlassian.

Jira and Atlassian are trademarks of Atlassian Pty Ltd.