Book a demo

Security

Security Policy · Version 1.0 · July 14, 2026

This page describes the security posture of Strategy Hub for Jira, published by CaskCode. Strategy Hub is built entirely on Atlassian Forge, Atlassian’s managed cloud app platform. That architecture is the foundation of our security model: the app has no servers, databases, or infrastructure of its own — application code runs inside Atlassian’s cloud, and customer data is stored in Atlassian-managed storage.

Hosting and infrastructure#

  • Strategy Hub runs exclusively on Atlassian Forge. We do not operate any servers, containers, or self-hosted services that process customer data.
  • All infrastructure security — physical security, network security, host patching, encryption at rest, availability — is provided and operated by Atlassian. See the Atlassian Trust Center for details on Atlassian’s certifications and practices.

Data storage and residency#

  • All customer content created in Strategy Hub (strategic items, comments, settings, backups) is stored in Atlassian-managed Forge storage (Forge SQL, Forge Key-Value Store, and Forge Object Store) within Atlassian’s cloud.
  • Because storage is Forge-hosted, app data automatically inherits your Jira site’s data residency: if your site is pinned to a region, Strategy Hub’s data is pinned to the same region. No action is required from administrators.
  • Data is encrypted in transit (TLS) and at rest by Atlassian.

Data leaving the Atlassian platform#

Strategy Hub sends no customer content outside the Atlassian platform. The only data egress is content-free operational telemetry:

  • Product analytics (PostHog, hosted in the EU — Frankfurt, Germany): pseudonymous usage events (feature used, screen viewed). Never item names, descriptions, comments, or any other user-authored text.
  • Error monitoring (Sentry, hosted in Germany): error reports containing technical identifiers and stack traces. Error messages are restricted to entity keys and codes — never user content.

All egress endpoints are declared in the app’s Forge manifest and disclosed on the Marketplace Privacy & Security tab. Session replay, where enabled, masks all on-screen text and images by design. See our Privacy Policy for full details.

Access control#

  • The app acts only within the OAuth scopes granted at installation (read-level Jira and Teams scopes plus app storage); administrators review and consent to these scopes when installing or upgrading.
  • Strategy Hub does not use Personal Access Tokens and does not store any credentials, tokens, or passwords.
  • In-app permissions (roles such as admin/editor/viewer) are enforced server-side on every request.

Secure development#

  • All changes are made through version control with code review and a mandatory automated test suite (unit, integration, and end-to-end tests) before release.
  • Dependencies are monitored and updated regularly.
  • As a Marketplace cloud app, Strategy Hub is continuously scanned by Atlassian’s Ecoscanner security monitoring program.

Vulnerability reporting#

If you believe you have found a security vulnerability in Strategy Hub:

Please include steps to reproduce and do not access data that is not yours. We acknowledge reports within 2 business days and remediate confirmed vulnerabilities within the timelines defined by Atlassian’s Security Bug Fix Policy for Marketplace apps. Vulnerabilities may also be reported through Atlassian’s Vulnerability Disclosure Program, which covers Marketplace apps.

Incident response#

In the event of a security incident affecting Strategy Hub, we follow Atlassian’s Marketplace incident process: we notify Atlassian promptly, cooperate with their security team, and inform affected customers without undue delay.