AI Duplicate Detector - Security

This Security Statement applies to AI Duplicate Detector, a Forge app for Jira published by Pokut Software (Pokutsoft) on the Atlassian Marketplace. It complements our Privacy Policy.

1. Security model: Runs on Atlassian

AI Duplicate Detector is built on Atlassian Forge and qualifies for the "Runs on Atlassian" model: all code runs inside Atlassian's cloud infrastructure and your data does not leave the Atlassian environment. There is no external server, and the app performs no external network egress.

2. Permissions and integration scope

The app requests the minimum permissions needed to detect duplicate issues. Its declared Forge scopes are:

• read:jira-work - read Jira project and issue data (issue summary, the first part of the description, project key) and search for candidate issues in the same project, including objects associated with issues such as attachments and worklogs.
• storage:app - read and write to the app-namespaced Forge storage service, used only for the short-lived result cache described below.

The app does not request user impersonation, administrative, or write access to your Jira issues.

3. Data storage, residency, and egress

• No data outside Atlassian: The app does not process or store End-User Data outside of Atlassian apps and services.
• Data residency: Because the app runs on Atlassian, in-scope End-User Data follows Atlassian's data residency and is stored within Atlassian's supported regions (for example United States, Australia, Germany, and France). For residency questions, contact support@pokutsoft.com.
• What is stored: Only a transient, app-namespaced cache of derived results (candidate issue key, candidate title, a duplicate score, and a short reason), kept for at most 24 hours to avoid recomputation.
• What is not stored: No Atlassian account personal data (email, username, account ID, or avatar) is retained.
• REST APIs: The app does not expose any public REST APIs.

4. AI / LLM security

Duplicate scoring uses Atlassian's hosted Forge LLMs (Anthropic Claude). Prompts are processed within Atlassian's infrastructure, no content is sent to an external LLM provider, and your data is not used to train models.

5. Data retention and deletion

Cached results expire automatically after 24 hours and are no longer read after that. If an issue's content changes, the derived hash changes and the old cache entry is invalidated. When the app is uninstalled, Atlassian clears the app-namespaced storage.

6. Compliance

• Marketplace Security Bug Bounty Program: Not currently a participant.
• Compliance certifications: None held at this time. The app inherits the security controls of the Atlassian Forge platform on which it runs.
• GDPR role: Pokutsoft is not a data controller for this app. Pokutsoft acts as a data processor limited to the transient processing of Jira issue content required to detect duplicate issues.

7. Reporting a vulnerability

If you discover a security issue in AI Duplicate Detector, please report it responsibly to support@pokutsoft.com with steps to reproduce. We will acknowledge your report and work to resolve confirmed issues promptly. Please do not publicly disclose a vulnerability before we have had a reasonable opportunity to address it.

8. Sub-processors

Atlassian is the only sub-processor: it provides hosting, the Forge platform, and the Forge LLMs service. Your data remains within Atlassian's boundaries.

9. Contact

Pokut Software (Pokutsoft), Istanbul, Türkiye
Phone: +90 501 660 43 60
Email: support@pokutsoft.com
Web: https://pokutsoft.com