Probatio Pro

Privacy Policy

Access Certification for Jira · Effective 22 September 2026 · Version 1.4

Who we are

Access Certification for Jira is published by Probatio Pro, a sole trader registered in France, SIRET 109 433 730 00016. Contact: contact@probatiopro.fr.

What the app reads

To produce an access review, the app reads the following from the Jira site it is installed on, using read-only permissions only:

• projects, their type, and their project lead;
• permission schemes and the grants they contain;
• project roles and the accounts or groups assigned to them;
• groups and their membership;
• user accounts — the Atlassian account ID, display name, account type, and whether the account is active;
• issue security schemes and the levels they define;
• global permissions, as Jira's own permission check reports them;
• the other holders a grant can name, including application roles and user-picker custom fields;
• the result of Jira's own effective permission check for each account.

Some of this is personal data: an account ID and a display name identify a person. The app reads it for one purpose — to determine who holds which right in Jira, and why — because that is the question an access review exists to answer.

Where it is stored, and where it is not

Results are written to Forge SQL, a database Atlassian provisions for each installation of the app and hosts within its own infrastructure. The data stays in your Atlassian environment and is subject to Atlassian's own data residency and security arrangements for your site.

We do not receive a copy. There is no server of ours, no account of ours holding your data, and no export to us of any kind. The only way data leaves your Atlassian environment is when somebody at your organisation downloads an evidence pack — and that file goes to them, not to us.

What this app never does

• No network calls outside Atlassian. The app declares no external permissions and no remote endpoints. Atlassian's own tooling checks the manifest for egress permissions and reports the app as eligible for Atlassian's Runs on Atlassian programme, which requires exactly this — measured on the production build, version 3.0.0, on 22 September 2026.
• No analytics, no tracking, no telemetry. We collect no usage statistics and operate no measurement of any kind inside the app.
• No third parties and no sub-processors. No data is shared with, sold to, or processed by anyone other than Atlassian as your platform provider.
• No writes to Jira. Every permission the app requests is a read permission. It cannot grant, revoke or modify any right, by design and not by policy.
• No personal data in diagnostic logs. The app is built so that account identifiers, names and group names are never written to the platform's logs. This is enforced automatically in our build, not left to care.

How long it is kept, and how it is deleted

• Retention. An extraction that an access review campaign certified is kept for seven years after that campaign closed, and for as long as the campaign is open. Every other extraction is deleted after 31 days — the point after which no campaign can be opened on it — and sooner when the next extraction of your site records exactly the same access. The newest extraction is always kept. Every deletion is recorded before it happens, with the extraction's dates, its content hash and the rule that deleted it. Neither period can be changed from the app. A review campaign is removed together with the extraction it reviewed.
• Uninstalling. Removing the app destroys its database, and with it every snapshot, finding and decision it held. This cannot be undone. If you need to keep evidence of a review that has taken place, export the evidence pack before uninstalling — that exported file is the durable record.

Roles and your rights

Your organisation decides what is read, when, and by whom — it controls the app's settings and its data. We provide software that runs inside your environment and hold no copy of what it produces.

Because of that, a request to access, correct or erase personal data held by this app is answered inside your own Atlassian instance. Be aware of what the app holds: a dated, sealed record of Jira's own configuration. It offers no way to edit a sealed snapshot or to remove one person from it — an evidence pack that could be edited would not be evidence. An administrator can uninstall the app, which destroys every snapshot at once; short of that, a snapshot leaves when the retention rule described above deletes it. If you are an individual whose data appears in a review, please contact your own organisation's administrator, who has the ability to act and the context to do so.

If you have a question about how the app handles data that your administrator cannot answer, write to contact@probatiopro.fr and we will answer it.

Security

The app inherits the security posture of Atlassian's Forge platform: Atlassian-hosted compute, Atlassian-hosted storage, and no network surface of our own. It declares twenty-six runtime dependencies, of which twenty-three are Atlassian's own; the other three are pdf-lib, react and react-dom. Access to the review inside Jira is restricted: by default only Jira administrators see it, and a designated group can be granted access by an administrator. A reviewer sees the rights assigned to them to review, which are other people's. Every other licensed account sees only its own rights, and any finding of which it is itself the subject.

Changes to this policy

If this policy changes, the version number and effective date at the top of this page change with it. Material changes — a new category of data read, a new recipient, a change in where data is stored — will be described here rather than absorbed silently.