Last Updated: May 15, 2026
At Pallas Software Inc., we take the security of our users and their data seriously. This page describes the technical and organizational measures we have in place to keep our services secure.
Our apps use Atlassian Forge's OAuth 2.0 authentication framework to access Jira Cloud APIs. We request only the minimum permission scopes necessary for each app to function, as declared in each app's manifest. User credentials are never stored or accessed by our apps. Forge handles authentication on our behalf, and we have no visibility into your Atlassian account credentials.
Our apps are built on two layers. The frontend runs on Atlassian Forge, which provides runtime isolation and Atlassian's secure infrastructure. We also maintain our own backend on AWS, which is necessary because our connectors need to be reachable at any time — for example, when Power BI or Tableau requests a data refresh on a schedule you have configured. Forge alone cannot support this kind of always-available connectivity, so our AWS backend handles it securely on your behalf. The two layers communicate over encrypted channels, and our AWS environment is configured with strict access controls, private networking, and firewall rules.
Our apps do not store your Jira data. Jira data is retrieved on demand and passed to your connected tool (Power BI or Tableau) without being persisted on our servers. We store only the configuration and metadata necessary for the connector to function, such as connection settings and field mappings. This metadata is encrypted at rest and in transit.
We offer data residency options for teams who require their configuration metadata and processing to remain within a specific geography. Currently supported regions are the United States (AWS us-east-1, N. Virginia) and the United Kingdom (AWS eu-west-2, London). Additional regions are available for larger teams. Data residency applies to the configuration metadata and backend processing performed by our apps, not to your Jira data itself, which is never stored by us.
All data transmitted between your Jira instance, our Forge frontend, and our AWS backend is encrypted in transit using TLS. Configuration metadata stored in our AWS infrastructure is encrypted at rest. We do not store any Jira issue data, so there is no Jira content at rest on our systems.
We regularly review and update dependencies across both our Forge frontend and AWS backend. Our apps comply with Atlassian Marketplace security requirements, including prompt resolution of high and critical severity issues in accordance with Atlassian's Security Bug Fix Policy. We conduct periodic reviews of our AWS environment to maintain a strong security posture.
Our Forge UI components implement Content Security Policy headers as defined in each app's manifest to mitigate risks such as cross-site scripting. Our public website applies equivalent modern web security practices.
Security is a shared responsibility. Atlassian is responsible for the security of the Forge runtime and Atlassian infrastructure. AWS is responsible for the security of the underlying cloud infrastructure we use. Pallas Software Inc. is responsible for the security of our code, configuration, access controls, and the data we manage within those environments.
If you discover a security vulnerability in any of our apps or infrastructure, please contact us promptly at support@pallas-apps.com. We take all reports seriously and aim to respond within one business day.