# Security > Strategy Hub's security posture as an Atlassian Forge app that runs entirely on Atlassian's infrastructure, storing no customer data of its own Canonical: https://docs.caskcode.io/strategy-hub/security/ **Security Policy · Version 1.0 · July 14, 2026** This page describes the security posture of **Strategy Hub** for Jira, published by CaskCode. Strategy Hub is built entirely on [Atlassian Forge](https://developer.atlassian.com/platform/forge/security/), Atlassian's managed cloud app platform. That architecture is the foundation of our security model: the app has no servers, databases, or infrastructure of its own — application code runs inside Atlassian's cloud, and customer data is stored in Atlassian-managed storage. ## Hosting and infrastructure - Strategy Hub runs exclusively on Atlassian Forge. We do not operate any servers, containers, or self-hosted services that process customer data. - All infrastructure security — physical security, network security, host patching, encryption at rest, availability — is provided and operated by Atlassian. See the [Atlassian Trust Center](https://www.atlassian.com/trust) for details on Atlassian's certifications and practices. ## Data storage and residency - All customer content created in Strategy Hub (strategic items, comments, settings, backups) is stored in Atlassian-managed Forge storage (Forge SQL, Forge Key-Value Store, and Forge Object Store) within Atlassian's cloud. - Because storage is Forge-hosted, app data automatically inherits your Jira site's **data residency**: if your site is pinned to a region, Strategy Hub's data is pinned to the same region. No action is required from administrators. - Data is encrypted in transit (TLS) and at rest by Atlassian. ## Data leaving the Atlassian platform Strategy Hub sends **no customer content** outside the Atlassian platform. The only data egress is content-free operational telemetry: - **Product analytics** (PostHog, hosted in the EU — Frankfurt, Germany): pseudonymous usage events (feature used, screen viewed). Never item names, descriptions, comments, or any other user-authored text. - **Error monitoring** (Sentry, hosted in Germany): error reports containing technical identifiers and stack traces. Error messages are restricted to entity keys and codes — never user content. All egress endpoints are declared in the app's Forge manifest and disclosed on the Marketplace **Privacy & Security** tab. Session replay, where enabled, masks all on-screen text and images by design. See our [Privacy Policy](https://docs.caskcode.io/strategy-hub/privacy) for full details. ## Access control - The app acts only within the OAuth scopes granted at installation (read-level Jira and Teams scopes plus app storage); administrators review and consent to these scopes when installing or upgrading. - Strategy Hub does not use Personal Access Tokens and does not store any credentials, tokens, or passwords. - In-app permissions (roles such as admin/editor/viewer) are enforced server-side on every request. ## Secure development - All changes are made through version control with code review and a mandatory automated test suite (unit, integration, and end-to-end tests) before release. - Dependencies are monitored and updated regularly. - As a Marketplace cloud app, Strategy Hub is continuously scanned by Atlassian's [Ecoscanner](https://developer.atlassian.com/platform/marketplace/ecoscanner/) security monitoring program. ## Vulnerability reporting If you believe you have found a security vulnerability in Strategy Hub: - Email us at **contact@caskcode.io**, or - Raise a ticket via our [support portal](https://caskcode.atlassian.net/servicedesk/customer/portal/1). Please include steps to reproduce and do not access data that is not yours. We acknowledge reports within 2 business days and remediate confirmed vulnerabilities within the timelines defined by Atlassian's [Security Bug Fix Policy for Marketplace apps](https://developer.atlassian.com/platform/marketplace/security-bugfix-policy/). Vulnerabilities may also be reported through Atlassian's [Vulnerability Disclosure Program](https://www.atlassian.com/trust/security/vulnerability-management), which covers Marketplace apps. ## Incident response In the event of a security incident affecting Strategy Hub, we follow Atlassian's Marketplace incident process: we notify Atlassian promptly, cooperate with their security team, and inform affected customers without undue delay. ## Related - [Privacy Policy](https://docs.caskcode.io/strategy-hub/privacy) — how Strategy Hub collects, stores, and protects personal data. - [Atlassian Forge platform security](https://developer.atlassian.com/platform/forge/security/) — the managed platform security model Strategy Hub inherits. - [Atlassian Trust Center](https://www.atlassian.com/trust) — Atlassian's certifications and infrastructure security practices.