Security & Data Handling
This page describes security and data-handling practices implemented in CFGORA today. It is not a certification or compliance statement.
OAuth-based Jira connection
CFGORA connects to Jira Cloud using Atlassian OAuth 2.0 (3LO). You authorize access directly with Atlassian. We never see or store your Atlassian password.
Requested Jira scopes
The application requests the following Atlassian scopes: offline access read:jira-work manage:jira-configuration. These scopes allow read access to Jira configuration and work data needed for health scans. CFGORA currently uses read-only Jira access.
Read-only Jira behavior
All Jira API usage is read-only. CFGORA currently uses read-only Jira access and does not automatically modify your Jira configuration. It analyses configuration and audit signals, generates findings, and tracks remediation plans internally. It does not create, update, or delete Jira issues, workflows, fields, or automation rules.
Encrypted OAuth tokens at rest
When DATABASE_URL and OAUTH_TOKEN_ENCRYPTION_KEY are configured, refresh tokens are encrypted with AES-256-GCM before being stored in the database. Access tokens are kept in HTTP-only session cookies and are not exposed to client-side JavaScript.
Server-side token handling
OAuth token exchange, refresh, and Jira API calls happen on the server. Tokens are not returned in API responses or logged.
Site isolation
Saved scans, findings, remediation plans, alerts, and schedules are associated with a specific Jira Cloud site (cloud ID). Data for one connected site is not mixed with another.
Stored scan summaries and findings
When scan history is enabled, CFGORA stores configuration health summaries, finding snapshots, and comparison metadata needed for trends and notifications. This data is stored in CFGORA, not in Jira.
Remediation data stored in CFGORA
Remediation plans and action checklists are tracked in CFGORA only. Completing a remediation item does not change Jira configuration.
Reconnect and token rotation
If a refresh token becomes invalid, the application marks the connection as requiring reconnect and prompts you to authorize again through Atlassian. Scheduled scans pause until the connection is restored.
Scheduled scans
When automatic scanning is enabled, a protected cron endpoint triggers read-only scans on your configured schedule. The cron endpoint requires a CRON_SECRET and does not accept unauthenticated requests.
Product independence
CFGORA is an independent product and is not affiliated with or endorsed by Atlassian.
Jira and Atlassian are trademarks of Atlassian Pty Ltd.