Security and data handling
The short version
TrueGantt runs entirely on Atlassian Forge. There is no server of ours, no database of ours, and no copy of your Jira data anywhere outside your Atlassian tenant. Installing the app does not add a vendor to your security review.
What we can access
Only what the app needs, and only while acting as the signed-in user:
- Issue key, summary, type, status, assignee, due date, the mapped start-date field, and issue links.
- Project permissions, to check whether you may read or edit.
We do not request access to attachments, comments, users' email addresses, or any other Jira data.
What we store
| Data | Where | Why |
|---|---|---|
| Start and end dates | Your Jira issue fields | So the chart matches the issue |
| Baseline snapshots | Forge-hosted app storage | To compare planned vs actual |
| App settings (mapped field) | Forge-hosted app storage | To remember your configuration |
Nothing is copied to a third-party service. Forge apps cannot make outbound network calls unless explicitly declared, and TrueGantt declares none.
Authentication and permissions
Every request runs as the logged-in Jira user through Atlassian's OAuth 2.0 framework. There is no service account and no elevated scope. Reading requires Browse Projects; writing requires Edit Issues and is checked per issue before any change is made. Jira's issue-level security applies throughout.
Data residency and compliance
Because the app runs on Forge and stores data in Forge storage, your data stays in the region your Atlassian tenant is pinned to. Atlassian's Forge platform holds SOC 2 and ISO 27001 certification; the app inherits those controls rather than duplicating them.
Sub-processors
None. We use no analytics, no error tracking, and no third-party services in the app.
Personal data
The only personal data the app displays is an issue assignee's display name, read live from Jira. It is not stored by us. If you need a data processing addendum, write to hello@truegantt.com.
Reporting a vulnerability
Email hello@truegantt.com with steps to reproduce. We acknowledge within two business days and will not pursue legal action against researchers acting in good faith.