Security

Runs on Atlassian, no egress, reads as the viewer, and no server of ours anywhere in the path.

Runs on Atlassian

RollGrid is built on Atlassian Forge and qualifies for Atlassian's Runs on Atlassian program: all data storage and all processing stay on Atlassian's own infrastructure. Eligibility is checked by Atlassian's tooling on every release, not claimed by us.

There is no egress. The app declares no external permissions, so it is not able to make an outbound connection even by mistake.

Reports run as the viewer

Every read of Jira is made from your browser, with your Jira credentials and your permissions. The app has no elevated read path for report data.

This has a consequence worth stating plainly: a report cannot show anyone work items their own Jira permissions would hide, no matter who shared it with them or how it was built. Two people can open the same report and correctly see different totals.

The one thing the app asks Jira as itself is whether an account is still active, so that reports belonging to people who have left can be found and cleaned up. That path reads no work item data.

Caching is per person

Every cached result is stored against the account ID of the person it was loaded for, and is only ever served back to that same person. There is no shared cache of report data, by design — a shared cache is how a reporting tool leaks across a permission boundary.

Cached results expire within four hours at most, and an admin can clear every cached result on the site at once.

RollGrid does not write to Jira

It holds read scopes only. It cannot create, change or delete a work item, worklog, board or dashboard. The move assistant, which inspects another vendor's dashboard gadgets, reads them with GET requests only and cannot alter another app's data.

Logging

Diagnostic logging records identifiers, counts and timings only — never names, email addresses, work item summaries or field values. This is enforced in code.

Storage and encryption

All storage is Atlassian-managed Forge storage, encrypted at rest and in transit by Atlassian, and following your site's data residency. We hold no copy of anything and have no access to your site's stored data.

Rate limits and denial of service

Jira limits how much an app may read per hour. RollGrid counts what it spends, refuses politely before exhausting the allowance, and caps a single report at 20,000 work items by default. Admins can change both. The point is that one oversized report cannot starve the rest of the site.

Reporting a vulnerability

Email hello@goldstandardweb.com with the detail. We aim to acknowledge within one business day and will keep you informed until it is resolved. Please give us a reasonable chance to fix an issue before disclosing it publicly.

What we do not claim

Honest limits, so nobody has to ask: RollGrid has not had an independent penetration test, and we are not in Atlassian's Cloud Fortified or Enterprise Certified programs. If your procurement requires either, tell us — it is a cost and a timetable question rather than an architectural one.