Security

Last updated November 13, 2026.

This page describes how Keepwell Apps builds and runs Issue Recovery for Jira. Keepwell Apps is a brand of Draco Ventures LLC, based in Colorado, USA. What the app stores and how long it keeps it is in the privacy policy.

Where the app runs

Issue Recovery for Jira runs on Atlassian Forge, the platform Atlassian provides for apps that run inside its own cloud. Atlassian lists the app as eligible for its Runs on Atlassian program.

• The app has no servers of its own.
• It stores data only in Forge storage, which Atlassian hosts and keeps separate for each Jira site.
• It makes no network calls outside Atlassian. The app's manifest declares none, and Atlassian blocks any that are not declared.
• It holds no passwords, API keys or tokens, and it never asks a user for one.

The security of the platform itself, including encryption, backups and physical security, is Atlassian's. Atlassian describes it at atlassian.com/trust.

What the app is allowed to do in Jira

The app asks for four permissions:

• read:jira-work, to read issues and check who administers a project.
• write:jira-work, to create a restored issue and add its comments, and to remove a restore that failed partway.
• read:jira-user, to show the names of people who appear in issues.
• report:personal-data, to tell Atlassian which accounts it holds data about, so closed accounts are erased.

Who can see the data

Inside Jira, only Jira site admins and the admins of a project can open the app. A project admin sees that project only. The app checks those rights again each time someone opens a deleted issue or restores one.

We cannot read your issues or the app's stored data in the normal course of running the app. Atlassian gives us error logs and usage figures. The app writes an error to the log only when a background job fails, and it keeps issue content and people's names out of those messages.

How the app is built

• The source code is in a private repository. Every change goes through a pull request.
• Automated tests run before each release, including tests that erase data while the app is in the middle of saving it.
• Each release is checked against Atlassian's rules for Forge apps before it is deployed.

We hold no security certifications such as SOC 2 or ISO 27001, and the app is not part of a bug bounty program.

Reporting a security problem

Write to security@keepwellapps.com. We reply within 2 business days. Please give us the chance to fix the problem before you share it publicly. We follow Atlassian's security bug fix policy for Marketplace apps.

If something goes wrong

If we learn that data the app stores was reached by someone who should not have reached it, we tell the affected customers without undue delay, and within 72 hours of confirming it. We also report it to Atlassian as its Marketplace rules require. The data processing agreement sets this out.