Architecture

TreeGuard runs entirely on Atlassian Forge. Compute and persistent KVS storage are provided by Atlassian. The app declares no remotes or external egress and uses no external analytics, advertising, or AI services.

Authorization and isolation

Jira requests run as the current user and remain subject to that user's Jira permissions. Protected operations verify the required project permissions. Private execution receipts are isolated with a project-scoped SHA-256 owner key; the raw Atlassian account ID is not persisted.

Data protection

Templates and bounded execution receipts stay in Forge KVS. Receipt data expires after 180 days, users can delete their own run history, and project administrators can delete shared templates. Persistent Forge storage follows the host Jira site's supported data-residency location and migration. TreeGuard treats all stored End-User Data as in-scope. Forge retains hosted storage for 28 days after uninstall; recovery requires customer consent and a request within 21 days.

Failure handling

Tree creation uses preflight checks, a durable journal, sequential Jira mutations, exact read-back verification, and reverse-order cleanup. Because Jira issue creation is not transactional, TreeGuard reports any residual issue requiring manual cleanup rather than claiming guaranteed rollback.

Report a vulnerability

Send reports privately to support@keelcroft.com with the subject Security. Include reproducible steps and impact, but do not access data that is not yours or send passwords, API tokens, or unrelated Jira content.