# Security Policy **Last updated:** May 19, 2026 NGPILOT, Inc. ("NGPILOT," "we," "us," or "our") is committed to protecting the security of our customers' data. This Security Policy describes the technical and organizational measures we implement to secure our Atlassian Marketplace applications and related systems. ## 1. Architecture Overview[​](#1-architecture-overview "Direct link to 1. Architecture Overview") All NGPILOT Apps are built on **Atlassian Forge**, Atlassian's serverless development platform. This means: * Our Apps execute within Atlassian's managed cloud infrastructure * All data processing occurs within the customer's Atlassian cloud tenant * No data is transmitted to, stored on, or processed by any external servers or infrastructure outside of Atlassian * Our Apps use only Atlassian's permission-scoped APIs with the minimum required access (principle of least privilege) This "Runs on Atlassian" architecture significantly reduces the security surface area, as Atlassian manages the underlying infrastructure, networking, and platform security. ## 2. Data Storage and Encryption[​](#2-data-storage-and-encryption "Direct link to 2. Data Storage and Encryption") ### Data at Rest[​](#data-at-rest "Direct link to Data at Rest") * Customer data accessed or generated by our Apps is stored within the customer's Atlassian cloud instance (Confluence, Jira, or Forge Storage) * Atlassian encrypts data at rest using **AES-256** encryption * We do not maintain any separate databases, file storage, or external backups of customer data ### Data in Transit[​](#data-in-transit "Direct link to Data in Transit") * All communication between our Apps and Atlassian services is encrypted using **TLS 1.2 or higher** * Atlassian enforces HSTS (HTTP Strict Transport Security) on all connections * No data is transmitted outside of Atlassian's infrastructure ### Secrets Management[​](#secrets-management "Direct link to Secrets Management") * API keys, OAuth tokens, and other secrets are stored in Atlassian Forge Secure Storage * Secrets are never hardcoded in source code, committed to repositories, or included in logs or URLs * Secret rotation is performed following Atlassian's recommended practices ## 3. Access Control[​](#3-access-control "Direct link to 3. Access Control") ### App-Level Access[​](#app-level-access "Direct link to App-Level Access") * Our Apps use Atlassian Forge's scope-based permission model, requesting only the minimum scopes necessary for each App's functionality * Access is authenticated and authorized on every API request * Users can review and control App permissions through their Atlassian administration console ### Organizational Access[​](#organizational-access "Direct link to Organizational Access") * Access to development tools, source code repositories, and Atlassian Marketplace accounts requires **multi-factor authentication (MFA)** * Access is granted on a need-to-know basis using the principle of least privilege * Unique, strong credentials are required for all systems * Access is reviewed periodically and revoked when no longer needed ## 4. Development Security[​](#4-development-security "Direct link to 4. Development Security") ### Secure Development Lifecycle[​](#secure-development-lifecycle "Direct link to Secure Development Lifecycle") * **Peer code reviews** are required for all changes before merging to production * **Pull requests** are mandatory for deploying to production environments * Code changes are deployed through Atlassian Forge's secure deployment pipeline, which includes app signing and verification ### Code Quality and Testing[​](#code-quality-and-testing "Direct link to Code Quality and Testing") * Automated testing is integrated into the development process * Source code is analyzed for security vulnerabilities during development * We follow secure coding practices aligned with the **OWASP Top 10** guidelines ### Dependency Management[​](#dependency-management "Direct link to Dependency Management") * Third-party libraries are regularly reviewed and updated * Libraries with known critical or high-severity vulnerabilities are promptly remediated * We maintain awareness of vulnerability disclosures for all dependencies ## 5. Vulnerability Management[​](#5-vulnerability-management "Direct link to 5. Vulnerability Management") ### Security Bug Fix Policy[​](#security-bug-fix-policy "Direct link to Security Bug Fix Policy") We adhere to Atlassian's Marketplace Security Bug Fix Policy: | Severity | Resolution Timeframe | | -------- | ------------------------ | | Critical | Within 10 calendar days | | High | Within 4 calendar weeks | | Medium | Within 12 calendar weeks | | Low | Within 25 calendar weeks | ### Reporting Vulnerabilities[​](#reporting-vulnerabilities "Direct link to Reporting Vulnerabilities") We welcome and encourage responsible disclosure of security vulnerabilities: * **Email:** * **Support Portal:** We commit to: * Acknowledging vulnerability reports within **5 business days** * Providing an initial assessment and severity classification within **10 business days** * Keeping reporters informed of remediation progress * Not taking legal action against good-faith security researchers ### Vulnerability Scanning[​](#vulnerability-scanning "Direct link to Vulnerability Scanning") * We perform regular vulnerability assessments of our App code * Dependencies are scanned for known vulnerabilities (Software Composition Analysis) * Static code analysis is applied to identify potential security issues ## 6. Incident Response[​](#6-incident-response "Direct link to 6. Incident Response") ### Incident Detection and Reporting[​](#incident-detection-and-reporting "Direct link to Incident Detection and Reporting") * Security incidents may be detected through monitoring, customer reports, or third-party notification * All personnel are trained to report suspected security deviations immediately ### Incident Handling Process[​](#incident-handling-process "Direct link to Incident Handling Process") Our incident response follows these stages: 1. **Detection and Triage:** Identify and classify the incident based on severity and scope 2. **Containment:** Take immediate action to prevent further impact 3. **Investigation:** Determine the root cause, affected systems, and scope of impact 4. **Remediation:** Implement fixes to resolve the vulnerability or issue 5. **Notification:** Notify affected customers and Atlassian as appropriate 6. **Post-Mortem:** Conduct a review to identify improvements and prevent recurrence ### Notification[​](#notification "Direct link to Notification") * We will notify Atlassian of security incidents through the appropriate Atlassian security channels (ECOHELP) as required by the Marketplace Partner Agreement * Affected customers will be notified via email or through our support portal within **72 hours** of confirmed impact * Notifications will include the nature of the incident, what data was affected, and remediation steps taken ## 7. Monitoring and Logging[​](#7-monitoring-and-logging "Direct link to 7. Monitoring and Logging") * Access to development and deployment systems is logged and monitored * Failed authentication attempts and access control changes are tracked * Logs are retained for a minimum of **12 months** where applicable * Atlassian provides platform-level monitoring and logging for the Forge runtime environment ## 8. Business Continuity[​](#8-business-continuity "Direct link to 8. Business Continuity") Because our Apps run on Atlassian Forge, business continuity for the underlying infrastructure is managed by Atlassian, including: * Redundant infrastructure across availability zones * Automated failover and recovery * Regular backup and disaster recovery procedures For our development and deployment processes, we maintain: * Source code in distributed version control with full history * Documented deployment procedures * Ability to roll back to previous App versions through the Atlassian Marketplace ## 9. Compliance and Certifications[​](#9-compliance-and-certifications "Direct link to 9. Compliance and Certifications") ### Atlassian Platform Compliance[​](#atlassian-platform-compliance "Direct link to Atlassian Platform Compliance") Our Apps benefit from Atlassian's compliance certifications, including: * SOC 2 Type II * SOC 1 (SSAE 18 / ISAE 3402) * ISO/IEC 27001 * CSA STAR For full details, see [Atlassian Trust & Compliance](https://www.atlassian.com/trust/compliance). ### NGPILOT Compliance[​](#ngpilot-compliance "Direct link to NGPILOT Compliance") We are committed to maintaining security best practices as a Marketplace partner. We regularly review and update our security measures in alignment with Atlassian's Security Guidelines for Marketplace Partners. ## 10. Human Resources Security[​](#10-human-resources-security "Direct link to 10. Human Resources Security") * Personnel with access to development systems undergo security awareness training * Security responsibilities are clearly defined and communicated * Access to systems is promptly revoked upon role change or departure ## 11. Policy Review and Updates[​](#11-policy-review-and-updates "Direct link to 11. Policy Review and Updates") This Security Policy is reviewed at least annually and updated as needed to reflect changes in our practices, technology, or regulatory requirements. Material changes will be communicated through appropriate channels. ## 12. Contact[​](#12-contact "Direct link to 12. Contact") For security-related questions, concerns, or vulnerability reports: * **Email:** * **Support Portal:** We aim to respond to security inquiries within **5 business days**.