Security
It runs on Forge, not on our servers
Vesper is an Atlassian Forge app. Its functions execute on Atlassian’s platform and its data lives in Forge storage. There is no server of ours in the path of your Jira data, and no database of ours holding your issues.
Every read carries your own permissions
Jira is read through asUser(), so each request runs with the viewing user’s own Atlassian permissions. Vesper cannot show anyone a story they could not already open in Jira, and a user without Browse Projects on a monitored project gets nothing back for it. Which views a person sees is a relevance decision, not a confidentiality one. The permission boundary is Jira’s own.
Least privilege
The manifest requests the minimum scopes needed to read the configured boards, and declares no external egress domains. Administrative actions such as changing monitored boards, field mappings or persona assignments require Jira administrator permission, checked on the server rather than by hiding a button.
Tenant isolation
Configuration and assignment records are scoped to a single installation. Records held per account are keyed by Atlassian account ID and refused on read when that ID does not match the requesting user.
Data lifecycle and privacy requests
Vesper stores only bounded configuration, role, audit and per-user review state in Forge. It does not persist complete Jira issue, comment, sprint or attachment snapshots. A weekly Forge privacy process reports accounts whose personal data remains stored, removes closed-account state, anonymises identity records where required and prunes expired review entries. A normal uninstall triggers deletion of Vesper-owned active storage for that installation.
Security incidents
If Vesper confirms a security incident affecting customer personal data, we will notify the affected customer or Jira site administrator without undue delay and, where feasible, within 72 hours. The notice will include the information available about scope, likely consequences, mitigation and follow-up contact.
Reporting a vulnerability
Please report suspected vulnerabilities to contact@vesperfocus.com rather than in a public issue. We will acknowledge receipt and keep you updated while we investigate.