Access Review Security
Access Review for Jira runs entirely on Atlassian Forge, inside Atlassian's own cloud. It has no servers of its own.
Runs on Atlassian
The app makes no network calls outside Atlassian. It declares no egress permissions at all, which is why it qualifies for Atlassian's Runs on Atlassian programme. Your permission configuration is never transmitted to Bobook Limited or to any third party, because there is nowhere for it to go.
Permissions requested
The app asks for exactly two scopes:
| Scope | Why |
|---|---|
read:jira-work |
Read the project list and the permission schemes, so the report can be produced |
storage:app |
Remember which permission you last reviewed |
The app requests no write access to Jira. It cannot grant, revoke or edit a permission, cannot change a scheme, and cannot add or remove anyone from a group or role. This is enforced by the Atlassian platform, not by our code — a write would be rejected because the permission was never granted.
This is the deliberate trade at the centre of the app. An access-review tool that can also change permissions is a tool an auditor has to treat as part of the control surface. This one cannot alter what it reports.
What it does not request
manage:jira-configuration — the administrative scope that would allow group
membership to be expanded into named people. The app does not ask for it, which
is why v1 reports group and role names rather than their members. We would
rather ship the narrower tool than hold the wider key.
What is stored, and where
Only the permission key you last selected, for example BROWSE_PROJECTS. A
few dozen bytes.
No project, scheme, grant, group name or person's name is ever stored. They are read when you press the button, used to compute the report in memory, returned to your browser, and discarded. Nothing is cached and nothing is written to a database.
Storage is Atlassian's Forge storage, hosted in Atlassian's cloud under Atlassian's own data residency and retention controls.
Who can see the report
Everything is read as the signed-in user. The report can never reveal a project that the person running it could not already see in Jira. The app is an admin page, so in practice that person is a Jira administrator.
Uninstalling
Uninstalling the app removes its stored setting. Since nothing else was ever stored, nothing else remains.
No certifications claimed
Bobook Limited does not hold ISO 27001, SOC 2, or any comparable certification, and none is claimed. Access Review produces evidence your own access-review process can use; it does not certify your organisation against any standard. We would rather say this plainly than let you discover it during an audit.
Reporting a vulnerability
Email support@bobook.club with "SECURITY" in the subject. We acknowledge within one business day.