Trace Gap Security
Trace Gap for Jira runs entirely on Atlassian Forge, inside Atlassian's own cloud. It has no servers of its own.
Runs on Atlassian
The app makes no network calls outside Atlassian. It declares no egress permissions at all, which is why it qualifies for Atlassian's Runs on Atlassian programme. Your issue data is never transmitted to Bobook Limited or to any third party, because there is nowhere for it to go.
Permissions requested
The app asks for exactly two scopes:
| Scope | Why |
|---|---|
read:jira-work |
Read issues, their types and their links, so the report can be produced |
storage:app |
Store your per-project settings |
The app requests no write access to Jira. It cannot create, edit, transition, comment on or delete an issue, and it cannot change a link. This is enforced by the platform, not by our code — a write would be rejected because the permission was never granted.
What is stored, and where
Only your configuration is stored: the project key, and the issue type and link type names you selected. That is a few dozen bytes per project.
No issue data is ever stored. Summaries, keys, statuses and links are read when you press the button, used to compute the report in memory, returned to your browser, and discarded. Nothing is cached and nothing is written to a database.
Storage is Atlassian's Forge storage, hosted in Atlassian's cloud under Atlassian's own data residency and retention controls.
Who can see the report
Everything is read as the signed-in user. The report can never reveal an issue that the person running it could not already open in Jira. Two people running the same report in the same project may legitimately see different numbers if their project permissions differ.
Uninstalling
Uninstalling the app removes its stored configuration. Since no issue data was ever stored, nothing else remains.
No certifications claimed
Bobook Limited does not hold ISO 27001, ISO 13485, SOC 2, or any comparable certification, and none is claimed. Trace Gap provides evidence your own validated process can use; it does not certify your organisation against any standard. We would rather say this plainly than let you discover it during an audit.
Reporting a vulnerability
Email support@bobook.club with "SECURITY" in the subject. We acknowledge within one business day.