Security — Support Attachment Sync for Jira

Last updated: 21 September 2026 (first publication of this page; it describes version 6, the version on sale today).

This page describes how the App handles and protects data, how we manage vulnerabilities, and what security certifications we hold. It is separate from the Privacy Policy, which lists what is stored; and from the Data Processing Agreement, which sets out the terms we process personal data under. Where the three overlap, the Privacy Policy is the authoritative list. It describes the version of the App that is on sale today.

1. Where the App runs

The App runs entirely on Atlassian Forge, inside Atlassian's infrastructure. There is no server of ours: no database, no file store, no queue outside Forge. Everything the App keeps is held in Forge storage, scoped to the installing Jira site, and Atlassian's own security controls apply to it; the transfers themselves wait in a Forge queue declared in the App's manifest. Diagnostic logs are written through the Forge logging platform and are described in section 2.

2. Data handling

• Attachment contents pass through; they are not stored. A file is read from Intercom® and written to the Jira issue as a native attachment in the same run. The App keeps no copy.
• Conversation text is not stored. The App reads a conversation to list its files on the issue panel, to confirm it exists before linking it, and to sync its files; message text is never written to the App's storage.
• What is stored is the link between a conversation and an issue, a record of the most recent sync for each issue, the most recent outcome recorded at the App's notification endpoint (not every request updates it), and the Intercom access token and client secret an administrator entered. The full table, including what a sync record contains, is in the Privacy Policy, section 2.
• Diagnostic logs: the App does not deliberately write attachment contents, conversation or message text, the access token or the client secret to its logs. When a call fails, the App logs an error message it composed; for Jira, that message includes the error text Jira returned, which can quote what was sent. The Privacy Policy, section 2, lists everything an entry can hold.

3. Encryption and transport

• In transit: every call the App makes — to Jira and to Intercom — is over HTTPS/TLS. Outside Atlassian, the App reaches only Intercom: api.intercom.io, and Intercom's file hosts to download the attachments themselves. Requests to the file hosts carry no access token. Every host is declared in the App's manifest and listed in the Privacy Policy, section 2.
• At rest: the Intercom access token and client secret are stored only through Forge's encrypted secret storage, and Disconnect on the settings screen deletes both.
• Incoming notifications: each notification Intercom sends to the App is verified with an HMAC-SHA1 signature over the raw request body, keyed with your client secret, before its payload is acted on. A payload that fails verification, or arrives before a secret has been saved, is discarded. The details are in the Privacy Policy, section 4.

4. Access control

• Jira permissions: the App requests read:jira-work, write:jira-work and storage:app, and no others. It does not request Jira administration rights and does not change project configuration.
• Who can act on an issue: before a person links a conversation, unlinks one, starts a sync, or opens the panel's list of files, the App checks that they may add attachments to that issue, and refuses if that check fails or cannot be made. A sync started by an Intercom notification has no person behind it: it acts only on a link that an authorised user created, using the App's own Jira permission. The check is on the Jira issue only — see the Data Processing Agreement, section 5, for what that means for access to Intercom conversations.
• Settings screen: only Jira admins — people with Jira's Administer Jira global permission — can connect, save the signing secret or disconnect. If the App cannot confirm that a person has that permission, it does not let them through — it does not guess.
• Isolation: Forge isolates data per installation. Data belonging to one Jira site is not visible to another.

5. Vulnerability management

• Reporting: email support@conduitworks.dev with "security" in the subject. One person reads that address, and we aim to acknowledge a report within two business days. We will tell you what we found and what we changed.
• Dependencies: the release on sale today includes two third-party packages with published high-severity advisories: linkify-it 2.2.0 and 3.0.3, a link parser used by Atlassian's user-interface packages (advisories published before that release shipped on 6 August 2026), and fast-uri 3.1.5, a URL parser (advisories published after it shipped). The next release updates both; npm audit reports no high or critical advisory in its production dependencies (checked on 15 September 2026). Before each release we now check the production dependencies for published advisories, and we do not release while a high or critical one is open.
• Testing: the App's code base now has an automated test suite, including tests that deliberately alter the code to confirm the checks would notice. Most of that suite was written after the release on sale today shipped. We have no penetration testing programme, have not commissioned a penetration test, and run no bug bounty.
• Breaches: if we become aware of a personal data breach affecting your data, we notify you without undue delay with what we know, as set out in the Data Processing Agreement, section 8.

6. Certifications

None. IDEAL WORKS does not hold SOC 2 or ISO 27001 certification, the App is not Cloud Fortified, and there is no independent audit report. We would rather you decide with that in front of you than discover it later.

7. Contact

support@conduitworks.dev

8. Trademarks

The Intercom name and logos are the trademarks or service marks of Intercom, Inc. or its affiliates in the U.S. and other countries. Atlassian, Jira and Forge are trademarks of Atlassian Pty Ltd. IDEAL WORKS is an independent vendor and is not affiliated with, endorsed by, or sponsored by Intercom, Inc. or Atlassian Pty Ltd. These names are used only to describe what this App interoperates with.