Claervo Privacy Guard for JSM
Security overview
The trust boundary, permissions and safeguards behind Claervo's JSM privacy controls.
Forge-only architecture
The application runs on Atlassian Forge with no external fetch permission, remote backend, external database, analytics endpoint or AI processor. Customer metadata stays in Atlassian-hosted compute and storage.
Least-privilege scopes
Scopes are limited to reading Jira/JSM access metadata, removing explicitly violating Organizations or Request participants, reading bounded organization membership data and storing tenant-local application state.
Authorization
Jira administrator checks protect the administration surface. Issue-specific actions require edit permission. Payloads, identifiers, numeric bounds and dynamic Jira paths are validated server-side.
Safe write path
Manual writes require explicit confirmation. Every remediation re-fetches current Jira data, re-evaluates applicable policy and records sanitized evidence. Monitor-only policies cannot trigger mutation.
Data minimization
The app does not read request descriptions, comments, attachment contents or customer-authored summaries. Logs, errors and exports are sanitized and tenant-scoped.
Responsible disclosure
Report suspected vulnerabilities privately to support@claervo.com with impact, safe reproduction steps and affected scope. Do not send live credentials or disclose the report publicly before coordination.