DetailBridge security

• DetailBridge runs entirely on Atlassian Forge, using Atlassian-hosted compute and storage. There is no zFinia server, Forge Remote backend or separate customer database.
• The app makes no requests to external hosts. It calls only Jira and Jira Service Management APIs, through Forge.
• It exposes no web triggers or public REST APIs.
• Customers do not provide passwords, personal API tokens or other credentials.

• The app requests only the Jira and Jira Service Management permissions it needs, shown when it is installed.
• Only Jira administrators can create, change or delete mappings, and DetailBridge re-checks that permission on every configuration change.
• Each mapping applies only to the service projects an administrator selects.

• Detail values are written into your Jira fields and are not stored in app storage.
• App storage holds configuration (mapped Detail names, Jira field and project identifiers) and sync status, including counts and example Jira issue keys.
• Logs, held in Atlassian's Forge logging, contain counts, outcome codes, mapping identifiers, Jira issue keys and HTTP status codes. They exclude Detail values, names, email addresses, account identifiers and credentials.
• DetailBridge never clears a field because of missing, invalid or ambiguous source data; only an explicitly empty Detail clears it.

The privacy policy and data processing agreement describe data handling in full: zfinia.com/detailbridge/privacy and zfinia.com/detailbridge/dpa.

• Software composition analysis: npm audit scans the complete and production-only dependency trees on every pull request, every change to the main branch and weekly. Any finding fails the check.
• GitHub Dependabot alerts and security updates are enabled, and Dependabot proposes npm and GitHub Actions updates weekly.
• Changes are tested before release with type checks, linting, automated tests, a build and Atlassian's Forge linter.

DetailBridge does not currently use static application security testing (SAST), dynamic testing (DAST) or third-party penetration testing, and holds no security certifications.

Email support@zfinia.com with "Security" in the subject. Include the affected site, steps to reproduce and any impact you observed. Please do not include customer data you do not need to share.