Security FAQ / Questionnaire

Yes. SaaSJet is SOC 2 Type II compliant following an independent third-party audit. We also run an active bug bounty program, participate in the Atlassian Cloud Fortified program, and fully comply with Atlassian security requirements.

Yes, we have a designated Security Officer responsible for ensuring compliance with security best practices and overseeing data protection policies.

Yes, SaaSJet maintains comprehensive security policies as part of our participation in the Atlassian Cloud Fortified program and SOC 2 compliance efforts.

Yes. All vendor employees undergo mandatory security awareness training at least once per year, and in practice 1–2 times annually depending on role and responsibilities.

Yes. All vendor employees undergo mandatory security awareness training at least once per year, and in practice 1–2 times annually depending on role and responsibilities.

Yes, access to client data is granted only to employees or contractors who require it for legitimate business purposes and is governed by strict security controls.

Access is provided based on the principle of least privilege, meaning individuals are granted the minimum level of access necessary to perform their job functions. Access rights are regularly reviewed and promptly revoked when no longer required.

Yes, we extend our rigorous audit processes to all subcontractors to ensure compliance with security policies.

Yes. All employees and contractors with system access undergo background checks, including criminal background screening, in compliance with local regulations.

Yes, every employee signs an NDA.

Yes.

Yes.

Yes.

Yes.

Yes, we strictly limit access to client data to authorized personnel based on business necessity.

Yes, we adhere to the principle of Least Privilege, ensuring users have only the access necessary to perform their duties.

We maintain a centralized system of record for identity. Google Workspace serves as the authoritative source for user identities and access status, with access granted and revoked based on role and employment status.

Yes, we conduct regular user audits to verify and manage active accounts and access rights.

Yes. Access is managed through Jira’s native roles, groups, and permission schemes, which our apps inherit and enforce.

Yes.

Not applicable (access is controlled within Jira via Atlassian permissions).

Yes.

Yes, we make sure the systems follow our SOC 2 requirements and Atlassian’s security practices.

Yes, we maintain comprehensive audit trails to track data access and user activity.

Yes, we conduct regular user audits to verify access rights and ensure compliance with internal security policies.

Yes, we extend our rigorous audit processes to subcontractors to ensure compliance with our security standards.

We do not provide logs from our apps.

Yes. We are SOC 2 Type II compliant, following an independent external audit, and conduct internal reviews to maintain compliance.

Yes.

Yes.

Event logs, server logs, system logs, authorization logs, and error logs.

Yes.

No.

SaaSJet is actively migrating its Jira Cloud apps to Atlassian Forge. Forge-based apps run entirely within Atlassian’s cloud infrastructure and align with Atlassian’s “Runs on Atlassian” principles, meaning customer data is processed and stored within Atlassian’s secure environment and does not leave the Atlassian platform.

SaaSJet apps process only the minimum data required to deliver functionality (e.g., work item metadata, workflow status, timestamps). SaaSJet does not process customer credentials, passwords, or payment information.

No. SaaSJet does not transfer or store PII on its servers. Some apps may read a user’s public display name from Jira to display it within the app UI (e.g., work item lists, user lists, exports, mentions) as part of in-product functionality.

For Forge-based apps, customer data is processed and stored within Atlassian’s cloud infrastructure. For non-Forge or transitional services, any data processed by SaaSJet is limited to what is necessary, encrypted, and securely hosted on AWS infrastructure.

Customer data is stored in accordance with Atlassian’s data residency policies for Jira Cloud. Where SaaSJet-managed infrastructure is used, SaaSJet cloud services are hosted in AWS data centers in the United States (including N. Virginia and Oregon).

SaaSJet shares personal data only when required by law or when necessary to deliver services (e.g., with cloud infrastructure providers such as AWS). Such providers act as processors on SaaSJet’s behalf and are contractually obligated to confidentiality and security standards.

Yes. We are audited by an independent third party and have achieved SOC 2 Type II compliance.

Yes, as a SaaS vendor, we maintain and test business continuity and disaster recovery programs to ensure operational resilience.

Yes.

Yes, we are participants of the Security Bug Bounty Program and follow partner security management best practices.

Yes, we are participants of the Bugcrowd bug bounty program.

Yes, our apps are part of the Atlassian Cloud Fortified program and follow Atlassian’s patching standards.

Compliant

SaaSJet holds a SOC 2 Type II attestation. An independent CPA (Certified Public Accountant) firm tested SaaSJet's controls over an observation period. You can request the SOC 2 Type II report through the SaaSJet Trust Center.

What is SOC 2?

SOC 2 (System and Organization Controls 2) is an independent review of how a company protects customer data. A licensed CPA (Certified Public Accountant) firm performs the audit against the Trust Services Criteria (TSC) from the AICPA (American Institute of Certified Public Accountants). The current version is the 2017 TSC, with revised points of focus added in 2022. SOC 2 is an attestation so the company receives a report with the auditor's opinion.

What's the difference between SOC 2 Type I and Type II?

• Type I checks whether a company's controls are designed correctly on one specific date.

• Type II checks whether those controls operated effectively over a period of time, usually 3, 6, or 12 months.

SOC 2 Type II gives stronger evidence, which is why most enterprise customers expect it.

Compliant

SaaSJet is compliant with the EU General Data Protection Regulation (GDPR). Controls implemented:

• Records of Processing Activities (RoPA), maintained together with our sub-processor list

• Data Protection Impact Assessments (DPIAs) completed for our products, under a documented DPIA methodology and register

• Access control: enforced SSO and MFA, approval-based access requests, periodic access reviews, access removed within 24 hours of an employee's departure

• Annual review of vendors, including sub-processors

• Incident response process with severity-based targets and post-incident reviews

• Regular security awareness training for employees

• Apps hosted entirely on Atlassian infrastructure do not process customer data on SaaSJet systems.

What is GDPR?

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, is the European Union's data protection law. It has applied since 25 May 2018. It covers organizations in the EU that process personal data, and also companies outside the EU that offer services to people in the EU or monitor their behavior.

What does it mean when a software vendor is GDPR compliant?

GDPR has no single official certificate that vendors commonly hold. A vendor shows compliance through documented processes and controls that customers can review. In practice, a GDPR-compliant vendor:

• knows what personal data it processes and why (RoPA)

• assesses privacy risk before high-risk processing (DPIA)

• protects data with technical and organizational security measures

• controls its own sub-processors

• can detect, contain, and report personal data breaches

Using a GDPR-compliant vendor helps you meet your own obligations as a data controller.

Support

SaaSJet is committed to supporting the operational resilience of our financial-sector customers as they meet their obligations under the Digital Operational Resilience Act (DORA). Our existing security and continuity controls are the foundation of that support.

Key measures

• ICT incident management: documented incident response process (triage, containment and fix, retrospective), severity-based response targets, post-incident review within one week of resolution, annual tabletop exercise

• Business continuity and recovery: backup restore tests at least quarterly and an annual business continuity exercise

• Change management: peer review and approval before every production release; emergency changes follow a defined path with retrospective review within five business days

• Access control: enforced SSO and MFA, approval-based provisioning, access removed within 24 hours of an employee's departure, periodic access reviews

• Third-party risk management: annual review of vendors, including sub-processors

• Security testing and monitoring: continuous penetration testing, bug bounty program, automated security alerting.

Supporting compliance and certifications: SOC 2 Type II attestation and GDPR compliance.

Does SaaSJet sign a DORA addendum?

SaaSJet reviews DORA addenda that customers provide. If your organization requires a DORA addendum, please send us your own for review at security@saasjet.com

What is DORA?

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, is the EU law on ICT risk in the financial sector. It entered into force on 16 January 2023 and has applied since 17 January 2025. It covers banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, and other EU financial entities.

DORA has five pillars:

• ICT risk management

• ICT-related incident management, classification, and reporting

• Digital operational resilience testing

• ICT third-party risk management

• Information sharing.

What does DORA mean for software vendors like SaaSJet?

DORA obligations sit with the financial entity. Software vendors aren't directly regulated unless the European Supervisory Authorities designate them as critical ICT third-party providers. However, financial entities must assess their ICT vendors and include specific terms in their contracts. These terms cover security, data location, incident assistance, audit rights, and exit. That's why financial institutions ask vendors for evidence of controls and for a DORA addendum.

Not applicable

BSI IT-Grundschutz is a methodology published by the German Federal Office for Information Security (BSI), used mainly by German public authorities and by organizations that choose to certify on its basis. It is not a requirement for SaaSJet as a software vendor, and we do not hold an IT-Grundschutz certification. Customers with specific requirements are welcome to contact us at security@saasjet.com.

Controls aligned

NIST - National Institute of Standards and Technology. NIST CSF 2.0 is a voluntary framework without certification. Our controls map to its core functions:

• Govern: dedicated Security Officer, policies reviewed annually, annual vendor risk reviews

• Identify: four-level data classification, RoPA and DPIAs, vendor risk assessments, bug bounty and continuous penetration testing

• Protect: enforced SSO and MFA, approval-based access provisioning, tiered periodic access reviews, access removed within 24 hours of departure, managed password vault, peer-reviewed and approved changes, security awareness training

• Detect: automated security alerting integrated into our incident workflow, continuous penetration testing

• Respond: documented Incident Response Plan with severity-based targets, post-incident review within one week, annual tabletop exercise

• Recover: backup restore tests at least quarterly, annual business continuity exercise, tracked remediation of failed tests.

SaaSJet's security controls are independently audited through SOC 2 Type II.

Controls aligned

CIS - Center for Internet Security. CIS Controls is a voluntary best-practice framework without certification. Our controls align with these areas:

• Data Protection (3): four-level data classification

• Account Management (5) and Access Control Management (6): enforced SSO and MFA, approval-based provisioning, least privilege, tiered access reviews, 24-hour access revocation

• Continuous Vulnerability Management (7) and Penetration Testing (18): continuous penetration testing, bug bounty program

• Data Recovery (11): quarterly restore tests, annual business continuity exercise

• Security Awareness and Skills Training (14): regular employee training

• Service Provider Management (15): annual vendor and sub-processor reviews

• Application Software Security (16): peer review and approval before release, defined emergency change path

• Incident Response Management (17): Incident Response Plan, severity-based targets, post-incident reviews, annual tabletop exercise.

SaaSJet's security controls are independently audited through SOC 2 Type II.

Not applicable

FISMA applies to US federal agencies and their contractors, and cloud services are authorized for federal use through FedRAMP. SaaSJet apps available in Atlassian Government Cloud (AGC) are built on Atlassian Forge and hosted in AGC, which is FedRAMP Moderate authorized. In line with Atlassian's Marketplace model, agencies review and authorize apps as part of their own process, and we provide security documentation to support that review.

SaaSJet's security controls are independently audited through SOC 2 Type II. To discuss your requirements, contact the SaaSJet security team at security@saasjet.com.

What is FISMA?

The Federal Information Security Modernization Act (FISMA) is a U.S. federal law that establishes information security requirements for U.S. government agencies and their contractors handling federal data. FISMA governs how U.S. federal agencies authorize and secure the information systems they use. This typically includes formal accreditation processes such as FedRAMP for cloud services.

Not applicable

All payments for SaaSJet apps are processed by Atlassian. SaaSJet does not collect, store or process payment card data, so PCI DSS requirements do not apply to our apps.

What is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard for protecting payment card data. It's maintained by the PCI Security Standards Council (PCI SSC), founded by American Express, Discover, JCB, Mastercard, and Visa. PCI DSS isn't a law: card brands and payment processors require it through their contracts with merchants and service providers.

Not applicable

SaaSJet is a privately held company and is not directly subject to the Sarbanes-Oxley Act (SOX). Customers can request our SOC 2 Type II report to support their own vendor assessments.

Not applicable

SaaSJet is not a HIPAA business associate. Our security program is independently audited through SOC 2 Type II, and customer data is protected under the same controls across our organization. For apps hosted entirely on Atlassian infrastructure, your data remains within your Atlassian environment and is not processed by SaaSJet. To discuss your requirements, please contact our security team at security@saasjet.com

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law, passed in 1996, that protects health information. It applies to:

• covered entities: health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically

• business associates: vendors that create, receive, maintain, or transmit protected health information (PHI) on a covered entity's behalf.

HIPAA has three main rules:

• the Privacy Rule sets how PHI can be used and disclosed

• the Security Rule requires administrative, physical, and technical safeguards for electronic PHI

• the Breach Notification Rule sets how breaches must be reported.

What does HIPAA mean for software vendors?

HIPAA does not have an official certification, and the US Department of Health and Human Services (HHS) does not certify vendors. If a vendor handles PHI for a covered entity, they are considered a business associate and need to sign a Business Associate Agreement (BAA).

Support is available via email at support@saasjet.com and via SaaSJet’s Support Portal (recommended for tracking and prioritizing requests).

Business hours are 9am–9pm CET, Monday through Friday.