SLA & Time to Resolution Reports security
Product-specific security information, last updated 23 October 2026. Coming soon: public installation and purchase are unavailable.
Access and permissions
The Forge manifest requests only read:jira-work. All Jira API requests run as the signed-in user through Forge asUser, subject to that person's project and request permissions. The read-only POST JQL search does not change Jira data.
The app reads project information, request keys and reporting fields, and native JSM SLA cycle information. It does not write requests, comments, SLA rules, calendars or project settings.
Hosting and data handling
Atlassian Forge hosts the application. The manifest configures no external egress or remotes. There is no app report database, Forge storage or persisted calendar configuration. Data is processed transiently to build the report and display it in the page.
Atlassian's platform logs, processing and retention are separate from app storage. We do not claim that the platform retains nothing. See the product privacy page for the data fields, downloads and support correspondence.
Exports and reporting limits
Your browser generates CSV and PDF files containing request keys and SLA metrics. CSV neutralizes spreadsheet formula prefixes. Protect and delete downloaded files according to your Jira data policies; the app stores no report copy.
Reports cover up to 500 requests created within a selection of up to 93 days. Missing SLAs, inaccessible requests and truncated SLA pagination reduce coverage. A local working-hours preview never overrides Jira's authoritative SLA values.
Verification status
The implementation checks production licences on the server. Authenticated real JSM scenarios and active, trial and inactive production licence acceptance remain unverified. Public documentation does not establish Marketplace approval, installation or sales.
No security certification, third-party audit, Cloud Fortified or other Atlassian trust badge is claimed.
Report a vulnerability
Email support@atesensoftware.com with the app name, a sanitized description, impact and reproduction steps. Do not include customer data, report exports, passwords or tokens. We aim to acknowledge every support email within two business days (Europe/Istanbul).
See the publisher security policy. The app is published by individual developer Samet Atesen under the Atesen Software name.