Security and data handling
Last reviewed: September 14, 2026
Budget Guard is built entirely on Atlassian Forge. Its runtime, static app assets and tenant-scoped persistent storage are hosted by Atlassian. The app has no Forge Remote, external application server or customer-configured egress.
Requested permissions
- read:jira-work: reads projects and worklogs required to calculate project budget usage.
- read:jira-user: resolves Jira users and project roles for user/role rates and summary recipients.
- write:jira-work: sends administrator-configured weekly summaries through Jira's issue notification endpoint. The app does not use this permission to create or delete issues.
- storage:app: stores budget settings, a minimized worklog ledger, synchronization state and audit entries for the installation.
- report:personal-data: reports cached profile references to Atlassian and processes account closure/update responses for name cleanup.
Access control
Every resolver operation that returns financial data or changes configuration checks Jira administrator permission on the server. Data export and deletion use the same administrator gate. Forge scopes storage separately for each app installation.
Stored data
The app stores Jira identifiers, cached display names, worklog timestamps and duration, budgets and user/role rates, recipient references, calculated-ledger inputs, synchronization/privacy-processing state and configuration audit metadata. It does not store worklog descriptions, issue summaries, comments, attachments, passwords, API tokens or payment-card information.
Data location and egress
Jira app data is processed and stored within Atlassian Forge services. It is not transmitted to HourMargin's website, website database or an external analytics provider. The public website's early-access form is a separate system and never receives Jira worklog or project-budget data.
Retention and deletion
A Jira administrator can delete all Budget Guard data associated with a project. After uninstallation, Atlassian Forge hosted storage retains installation data for up to 28 days under its documented data lifecycle.
Site-wide deletion also covers shared privacy-processing state. The personal-data reporting flow removes cached names on account closure/update; it does not automatically erase all account-linked worklogs, rates or financial history. Broader deletion requests use the verified privacy process described in our Customer Data Processing Addendum.
Security practices
- Least-privilege Forge scopes and no external egress.
- Server-side authorization for financial reads and writes.
- Integer minor-unit money calculations and repeatable reconciliation.
- Automated tests, dependency auditing and Forge lint checks before release.
- Responsible handling of vulnerability reports and remediation under Atlassian Marketplace security timelines.
Report a vulnerability
Email support@hourmargin.com. Include reproduction steps and impact, but do not include real customer financial data or credentials. We aim to acknowledge security reports within one business day.