Security policy

Last updated 4 November 2026

How our apps are built

Every Clearlane app is built on Atlassian Forge and runs on Atlassian’s infrastructure (Runs on Atlassian). We operate no servers of our own.
The records an app keeps are stored in Atlassian’s Forge storage for your site, encrypted at rest and in transit by Atlassian. Availability follows Atlassian’s platform: see our app status page.
Authentication and authorisation are handled by Atlassian. Our apps act with the permissions of the person using them and cannot see anything that person cannot see. One exception: Clearlane Budget reads worklogs with the app’s own access so a budget shows the same figures to everyone allowed to see it; only Jira administrators and the budget managers they name can create budgets, and only for projects they can browse. Clearlane CAPA’s daily run reads the status of action work items and sends at most one reminder e-mail a day per owner through Jira, with the app’s own access. Clearlane CRA’s hourly run checks once a day that case work items still exist, has Jira send each owner one reminder e-mail a day and updates the searchable CRA fields, with the app’s own access. Clearlane Tests’ hourly run updates the searchable coverage fields of requirements and has Jira send each tester at most one reminder e-mail a day, with the app’s own access, after checking that the person can browse the project. Clearlane Breach & Incident Reporting’s hourly run updates the searchable incident fields, checks once a day that incident work items still exist and has Jira send each owner at most one reminder e-mail a day, with the app’s own access. Clearlane Read & Understood’s daily run posts at most one reminder comment a day per reader, only on a page that reader can open. Clearlane Risk Register reads only the person’s own groups with the app’s own access, to check whether they are a risk manager; its hourly run updates the searchable risk fields, checks that risk work items still exist and has Jira send each owner at most one reminder e-mail a day, with the app’s own access. Clearlane Delivery’s Budget part reads worklogs with the app’s own access, exactly as Clearlane Budget does, and its hourly run reports the account IDs it keeps to Atlassian.
Apps request the smallest set of permissions they need. Clearlane Forecast only reads Jira work items; Clearlane Pulse only reads Jira (work items, their status changes, statuses and projects) and keeps short-lived caches in Atlassian’s storage for your site; Clearlane Fresh reads Confluence pages and edit dates; Clearlane Controlled Documents only adds page restrictions, never removes existing ones; Clearlane Answers creates pages and comments only when a person asks or answers, with that person’s permissions; Clearlane Budget only reads Jira work items, worklogs, people and groups; Clearlane CAPA creates work items, links and a work item property only for CAPAs and their actions, with the permissions of the person who asks, and shows a CAPA only to people who can see its work item; Clearlane CRA creates work items and attachments only for its cases, with the permissions of the person who asks, adds a work item property only to its cases’ work items, sends reminder e-mails only to case owners, and shows a case only to people who can see its work item; Clearlane Tests creates bugs and evidence attachments only when a person asks, with that person’s permissions, adds a work item property only to the requirements its test cases cover, and shows a project’s tests only to people who can browse that project; Clearlane Breach & Incident Reporting creates work items and attachments only for its incidents, with the permissions of the person who asks, adds a work item property only to its incidents’ work items, sends reminder e-mails only to incident owners, and shows an incident only to people who can see its work item; Clearlane Created vs Resolved, Clearlane Throughput, Cumulative Flow – Clearlane, Sprint Burndown – Clearlane and Velocity – Clearlane only read Jira, as the person viewing the dashboard; Clearlane Read & Understood adds comments only to remind readers and a page property only for its byline, and shows who has read a page only to the person responsible for the request, the requester and space administrators; Clearlane Risk Register creates and links work items only when a person asks, with that person’s permissions, adds a work item property only to its risks’ work items and sends reminder e-mails only to risk owners; Clearlane Delivery uses, part by part, the permissions of the matching single apps, and a part a Jira administrator turned off refuses every call; Clearlane Automation Steps & Cost only reads search counts, the list of projects and their permissions, as the person using it, and changes nothing; Clearlane Planning Poker reads work items and writes the agreed estimate (Story Points, Story point estimate or original estimate) only as the person using it.
No customer content is copied, sent or stored outside Atlassian. The data our apps keep (Clearlane Fresh’s page confirmations, Clearlane Controlled Documents’ document records and audit trail, Clearlane Answers’ topics and question records, Clearlane Budget’s budgets, rates and figures, Clearlane CAPA’s CAPA records and audit trail, Clearlane CRA’s cases, products, SBOM component lists and audit trail, Clearlane Tests’ test cases, campaigns, results and history, Clearlane Breach & Incident Reporting’s incidents, breach register and audit trail, the 10-minute caches of Clearlane Created vs Resolved and Clearlane Throughput and the one-hour caches of Cumulative Flow – Clearlane, Sprint Burndown – Clearlane and Velocity – Clearlane (what they have just shown or read), Clearlane Read & Understood’s read requests, confirmations, quiz answers and audit trail, the caches kept at most 24 hours by Clearlane Pulse, WIP Aging – Clearlane and Cycle Time – Clearlane, without account IDs, and Clearlane Risk Register’s risks, reviews and history, Clearlane Delivery’s data (each part as its single app, plus the parts turned on and usage counters without account IDs), Clearlane Automation Steps & Cost’s plan and the totals of its last 12 analyses, Clearlane Planning Poker’s sessions, anonymous votes and rounds (deleted 45 days after a session’s last change), and the usage counters and short-lived caches with which Clearlane Fresh, Clearlane Created vs Resolved, Clearlane Throughput, Cumulative Flow – Clearlane, Sprint Burndown – Clearlane and Velocity – Clearlane share Jira’s and Confluence’s request limits fairly) stays in Atlassian’s storage for your site.
Data residency: the data our apps keep sits in Atlassian’s Forge storage for your site. If your Jira or Confluence is pinned to a region, that stored data is pinned to the same region and moves with your site (Atlassian documentation). Atlassian may occasionally run processing outside your region.
Clearlane CRA, CAPA, Tests, Budget, Forecast, Controlled Documents and Read & Understood add a Rovo agent whose actions only read, and only return what the person asking may see in the app. Answers are written by Rovo, Atlassian’s AI, under Atlassian’s terms; our apps call no AI model of their own.
Signing passwords in Clearlane Controlled Documents, Clearlane CAPA, Clearlane CRA, Clearlane Tests, Clearlane Breach & Incident Reporting, Clearlane Read & Understood and Clearlane Risk Register are stored only as a salted scrypt hash in Atlassian’s secret storage, and signing locks after repeated failures.
Logs contain technical counters only (such as the number of work items processed), never customer content.
We do not ask for passwords, API tokens or other secrets.

Security questionnaires

Our full CAIQ v4.1 answers are listed in the CSA STAR Registry (Level 1 self-assessment, not an audit). The CAIQ-Lite answers, our supplier assessment and our DORA and NIS2 supplier addendum are on our trust center.

Reporting a vulnerability

Use “Report a security issue” in our help center (or write to hello@clearlaneapps.com) with the app name, the steps to reproduce and the impact you observed. We keep you informed while we investigate, and fix confirmed issues as a priority. Please give us reasonable time to fix an issue before disclosing it publicly, and do not access or change data that is not yours.

Our commitments

Incident notification: If we become aware of a security incident affecting data processed by our apps, we notify the affected customers without undue delay, and no later than 72 hours after becoming aware of it, with what we know, what we are doing and the steps we recommend. Further details follow as they become available. This commitment supplements our DPA, which prevails.

Vulnerability reports: We acknowledge receipt of every report sent through the contact given on this page within 2 business days (Monday to Friday, excluding French public holidays).

For a summary to use in a vendor assessment, see our trust center.