Senyi Labs
Security
How Herald protects your data.
Built on Atlassian Forge
Herald runs on Atlassian Forge, Atlassian's own app platform. Its code, storage and logs are hosted and secured by Atlassian. Herald has no servers or databases of its own. Data leaves Atlassian only to go to the Google Chat spaces your administrators connect.
Least privilege
Herald asks Jira only for what it needs:
| Permission | Used for |
|---|---|
| Read Jira work items and users | Reading the issues, comments and names that go into notifications |
| Read boards and issue details | Finding the project a sprint belongs to |
| Send Jira notifications | Failure alert emails |
| App storage | Herald's own settings and delivery log |
Herald cannot create, edit or delete anything in Jira. Outgoing connections are limited to chat.googleapis.com.
Access control
- Every settings request is checked with Jira, as the person making it: Jira administrators manage everything, project administrators only their own project's connections.
- Webhook URLs are stored in Forge's encrypted secret storage, are never shown again after saving, and are never written to logs.
Private content
By default Herald does not send issues with a security level, comments restricted to a group or role, or internal service-desk comments.
Reporting a vulnerability
Please use the contact form and choose the topic Security. We reply within two business days.