Security FAQ / Questionnaire

Yes. SaaSJet is SOC 2 Type II compliant following an independent third-party audit. We also run an active bug bounty program, participate in the Atlassian Cloud Fortified program, and fully comply with Atlassian security requirements.

Yes, we have a designated Security Officer responsible for ensuring compliance with security best practices and overseeing data protection policies.

Yes, SaaSJet maintains comprehensive security policies as part of our participation in the Atlassian Cloud Fortified program and SOC 2 compliance efforts.

Yes. All vendor employees undergo mandatory security awareness training at least once per year, and in practice 1–2 times annually depending on role and responsibilities.

Yes. All vendor employees undergo mandatory security awareness training at least once per year, and in practice 1–2 times annually depending on role and responsibilities.

Yes, access to client data is granted only to employees or contractors who require it for legitimate business purposes and is governed by strict security controls.

Access is provided based on the principle of least privilege, meaning individuals are granted the minimum level of access necessary to perform their job functions. Access rights are regularly reviewed and promptly revoked when no longer required.

Yes, we extend our rigorous audit processes to all subcontractors to ensure compliance with security policies.

Yes. All employees and contractors with system access undergo background checks, including criminal background screening, in compliance with local regulations.

Yes, every employee signs an NDA.

Yes.

Yes.

Yes.

Yes.

Yes, we strictly limit access to client data to authorized personnel based on business necessity.

Yes, we adhere to the principle of Least Privilege, ensuring users have only the access necessary to perform their duties.

We maintain a centralized system of record for identity. Google Workspace serves as the authoritative source for user identities and access status, with access granted and revoked based on role and employment status.

Yes, we conduct regular user audits to verify and manage active accounts and access rights.

Yes. Access is managed through Jira’s native roles, groups, and permission schemes, which our apps inherit and enforce.

Yes.

Not applicable (access is controlled within Jira via Atlassian permissions).

Yes.

Yes, we make sure the systems follow our SOC 2 requirements and Atlassian’s security practices.

Yes, we maintain comprehensive audit trails to track data access and user activity.

Yes, we conduct regular user audits to verify access rights and ensure compliance with internal security policies.

Yes, we extend our rigorous audit processes to subcontractors to ensure compliance with our security standards.

We do not provide logs from our apps.

Yes. We are SOC 2 Type II compliant, following an independent external audit, and conduct internal reviews to maintain compliance.

Yes.

Yes.

Event logs, server logs, system logs, authorization logs, and error logs.

Yes.

No.

SaaSJet is actively migrating its Jira Cloud apps to Atlassian Forge. Forge-based apps run entirely within Atlassian’s cloud infrastructure and align with Atlassian’s “Runs on Atlassian” principles, meaning customer data is processed and stored within Atlassian’s secure environment and does not leave the Atlassian platform.

SaaSJet apps process only the minimum data required to deliver functionality (e.g., work item metadata, workflow status, timestamps). SaaSJet does not process customer credentials, passwords, or payment information.

No. SaaSJet does not transfer or store PII on its servers. Some apps may read a user’s public display name from Jira to display it within the app UI (e.g., work item lists, user lists, exports, mentions) as part of in-product functionality.

For Forge-based apps, customer data is processed and stored within Atlassian’s cloud infrastructure. For non-Forge or transitional services, any data processed by SaaSJet is limited to what is necessary, encrypted, and securely hosted on AWS infrastructure.

Customer data is stored in accordance with Atlassian’s data residency policies for Jira Cloud. Where SaaSJet-managed infrastructure is used, SaaSJet cloud services are hosted in AWS data centers in the United States (including N. Virginia and Oregon).

SaaSJet shares personal data only when required by law or when necessary to deliver services (e.g., with cloud infrastructure providers such as AWS). Such providers act as processors on SaaSJet’s behalf and are contractually obligated to confidentiality and security standards.

Yes. We are audited by an independent third party and have achieved SOC 2 Type II compliance.

Yes, as a SaaS vendor, we maintain and test business continuity and disaster recovery programs to ensure operational resilience.

Yes.

Yes, we are participants of the Security Bug Bounty Program and follow partner security management best practices.

Yes, we are participants of the Bugcrowd bug bounty program.

Yes, our apps are part of the Atlassian Cloud Fortified program and follow Atlassian’s patching standards.

We have implemented security and privacy controls aligned with GDPR principles and are actively working toward full GDPR compliance. Our data protection practices are supported by SOC 2 Type II – compliant controls.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

Not applicable.

Support is available via email at support@saasjet.com and via SaaSJet’s Support Portal (recommended for tracking and prioritizing requests).

Business hours are 9am–9pm CET, Monday through Friday.