Security Overview
Discord for Jira is built with security as a core principle. We follow a defense-in-depth approach to protect your data.
Infrastructure
Discord for Jira runs on Microsoft Azure with isolated production and development environments. Persistent application data is stored in Azure SQL Database with encryption at rest, automated backups, and network isolation.
Application-owned credentials and long-lived secrets are stored in Azure Key Vault - never in source code. Production uses managed identity authentication. Short-lived Forge app-system tokens are held in encrypted Azure SQL for authorized background processing and expire within four hours. Application Insights provides access-controlled monitoring. Forge failures retain exception details and failed admin inputs for diagnosis, while credentials and full Jira webhook bodies are excluded.
Authentication
| System | Method |
|---|---|
| Forge requests | Signed Forge Invocation Tokens and scoped app/user OAuth tokens |
| Legacy Connect requests | JWT with per-installation symmetric keys |
| Discord commands | Ed25519 signature verification |
| User linking | OAuth 2.0 with minimal scopes |
The app inherits Jira's permission model - if a user can't access a project in Jira, they can't access it through Discord. Discord role-based access control adds another layer for command permissions.
Data Handling
We persist only what's necessary to operate the integration: IDs, configuration, integration metadata, and short-lived Forge app-system tokens. Jira issue and ticket content is otherwise fetched when needed and sent to configured Discord destinations for requested notifications and conversations; it is not retained as a separate copy in the app database.
AI-assisted ticket workflows use Azure OpenAI to process selected Discord and Jira data and provide ticket suggestions or workflow actions. Temporary preview data is removed after the interaction or when it expires.
All communication uses HTTPS with TLS 1.2+. JWT parameters and tokens are stripped from logs before storage. We use Jira account IDs rather than names or emails in telemetry.
Atlassian Marketplace
As a Marketplace app, Discord for Jira undergoes Atlassian's security review process and must comply with their security standards. The permission model is transparent - you can see exactly what access the app requests during installation.
GDPR & Compliance
We're fully GDPR compliant. User data can be deleted on request, and we offer a Data Processing Agreement for customers who need it. Data is stored in Azure's EU regions. The app does not currently provide customer-selected Forge realm pinning or Runs on Atlassian.
See our Privacy Policy for complete details.
Reporting Vulnerabilities
Found a security issue? Email contact@firnity.com with:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
We aim to respond within 48 hours.