PPFTECSecurity Policy — Customers & Organizations Importer for JSM
Last reviewed: 23 October 2026.
This document describes the current application architecture and security practices of Customers & Organizations Importer for JSM, an independent PPFTEC S.R.L. app for Jira Service Management Cloud. It is separate from our Privacy Policy. It does not constitute a security certification or a determination of GDPR roles or DPA requirements.
Application and data handling
The app runs as a Forge Custom UI page in Jira admin settings. Atlassian hosts the static application assets. The app has no application backend, Forge functions, scheduled jobs, app-owned database or configured external network destinations.
When an administrator selects or pastes CSV content, the browser processes customer email addresses, names, organization names and service-project identifiers. The app reads Jira records and can create customers and organizations, add memberships and link them to service projects through Jira APIs. Those records persist in the customer's Jira site under Atlassian's controls and the customer's configuration. Their location and retention are not determined by a separate PPFTEC database.
The application does not transmit customer CSV content or Jira results to a PPFTEC backend. It does not implement customer-data logging, visitor analytics or persistent browser storage such as localStorage or IndexedDB. Data remains in the active page's memory during use; closing or resetting the page is not a secure-erasure guarantee. Information voluntarily sent to support is a separate communication and may contain personal data.
Access and permissions
The app uses Atlassian's requestJira browser bridge, which makes requests as the interacting user. Jira permissions and the app's declared scopes both constrain API access. The app does not request passwords, personal access tokens or API credentials from administrators, and has no backend service account.
The declared scopes are manage:servicedesk-customer for customer and organization operations, read:servicedesk-request for service-project discovery, and read:jira-user for resolving existing user accounts. Administrators should review the selected organizations, projects and planned access changes before importing. Access follows Jira authorization; a client-side licence check is not an additional security boundary.
Encryption and responsibility
Communication with Jira uses Atlassian's HTTPS platform and API controls. Atlassian documents encryption in transit and encryption at rest for Jira Service Management in its Security Practices. These are Atlassian platform controls; PPFTEC does not operate a separate encryption-key service or customer-data store for this app. Application logic, validation and dependency maintenance remain PPFTEC responsibilities under the Forge shared responsibility model.
The app does not encrypt selected files, downloaded CSV reports or clipboard copies. Exports and reports can contain names, emails and API error details. The customer's device, browser, storage, clipboard management and sharing practices govern those copies. Restrict access and keep or delete them according to your own policies; app removal does not remove those copies or Jira records.
Input, output and operational safeguards
File selection is limited to 5 MB and import preparation limits input to 10,000 rows. The app validates mapped rows before import, displays a plan and offers a dry run that skips write operations. CSV output escapes delimiters and quotes and prefixes cells starting with selected spreadsheet-formula characters with an apostrophe. This mitigation is not a guarantee about every spreadsheet application; treat imported and exported content as untrusted. User content is rendered as React text rather than injected HTML.
Imports perform sequential phases with bounded request concurrency and retry handling. Stopping an import retains completed changes and does not roll them back. Review the result report and Jira state before retrying; administrative operations may affect customer access. The app does not provide a background synchronization or automatic deletion service.
Vulnerability reports and maintenance
Report suspected vulnerabilities privately to security@ppftec.com, using the process in our company Security Policy. Include the app name, affected version, impact and minimal reproduction steps using synthetic data where possible. Do not include passwords, tokens or customer lists. The company process aims to acknowledge receipt within five business days; this is an aim, not a guaranteed resolution deadline. There is no paid bug bounty programme.
The maintenance process is to assess reports and dependency findings for applicability and severity, distinguish application dependencies from development tools, prepare and test fixes, and obtain release authorization before deployment. Relevant incidents are handled using Atlassian's app security incident guidelines and security bug-fix policy, including applicable customer/platform notification requirements. This is a process statement, not evidence that a report has been resolved or a release shipped.
Assurance and limitations
Local automated tests, builds and manifest/package checks support maintenance. They do not replace penetration testing or guarantee absence of vulnerabilities. PPFTEC makes no claim here of independent penetration testing, app-specific ISO/SOC certification, continuous security monitoring or paid bug-bounty participation. Atlassian's platform certifications are not certifications of this application. Marketplace review is a separate process and is not final approval until Atlassian confirms it.