Security Policy — DORA Register of Information

This security policy describes the technical and organisational security measures of the Atlassian Marketplace app "DORA Register of Information" by maplee GmbH. For how we handle personal data, see the Privacy Policy at /legal/dora/privacy.

The app is built on Atlassian Forge and runs entirely on Atlassian infrastructure; maplee operates no servers for this app. Backend and UI communicate exclusively through Forge resolvers — the app exposes no custom HTTP endpoints.

Register data (the 15 Register of Information templates) is stored in Forge SQL, a managed relational database on Atlassian infrastructure; each installation is provisioned with its own isolated database instance. App settings and export-history metadata are stored in Forge KVS per installation and contain no user references (no Atlassian account IDs). Export packages (xBRL-CSV ZIP) are generated on demand in the Forge backend and streamed to the user's browser — they are never persisted server-side. Storage follows Atlassian's Forge hosted-storage residency: data is hosted in the Atlassian Cloud region of the site in line with the site's data-residency settings, to the extent Atlassian supports data residency for Forge hosted storage.

The app calls exactly one external endpoint, declared in the Forge manifest and consented to by the site admin at installation: https://api.gleif.org, used to validate a Legal Entity Identifier (LEI) against the public GLEIF register. Only the 20-character LEI string is sent; no data is stored there (read-only lookup). There are no analytics, no telemetry, no tracking and no other third-party services.

The app acts exclusively via its own app identity (asApp) within the customer's site; there is no user impersonation. Its Jira permissions are limited to three scopes: read:jira-work, write:jira-work and storage:app. The app stores no credentials or secrets and uses no external accounts.

All writes pass a central data-access layer that enforces referential integrity, type and enum validation and length limits. SQL access happens exclusively via prepared statements with bound parameters.

46 automated tests cover the integrity rules, the validation engine and the export.

All app data lives in Forge hosted storage tied to the installation. On uninstall, Atlassian retains the hosted storage for 28 days and then deletes it. In addition, the app provides a "Delete all register data" action in its settings for immediate purging.

Please report suspected vulnerabilities to kontakt@maplee.de. We confirm receipt and keep reporters informed about the remediation.