Unitlane Apps
Try RequestOps

Last updated 13 October 2026

RequestOps Security Statement

Overview

RequestOps is an Atlassian Forge app. It runs in Atlassian’s hosted runtime and stores app data in Forge hosted storage and as properties on the customer’s own Jira requests. The app makes no calls to servers outside Atlassian (no external egress is declared).

Access and permissions

  • The app asks only for the Jira, Jira Service Management and Forge permissions it uses; each is explained on the listing and in the scope list. It does not ask customers for passwords, API tokens or personal access tokens.
  • Screens run with the signed-in person’s Jira access. Jira permissions are checked on every action; the app cannot give anyone more access than Jira does.
  • Customer portal views show only what the team chooses to share and only for requests the customer can see.
  • Administrator-only settings are enforced on the server, not only in the browser.
  • The app checks its Marketplace licence on the server for the paid features.

Data protection

  • Data stays inside Atlassian’s platform, which provides encryption in transit and at rest and tenant separation for Forge storage.
  • Inputs are validated on the server with strict schemas before they are used or stored.
  • One-time links sent to outside parties are signed, expire, and work once; a used or expired link cannot be reused.
  • Messages are previewed before sending and held for a short Undo period.
  • The app writes no request text or personal data to its diagnostic logs beyond fixed outcome, timing and error codes.
  • No telemetry or analytics are collected.

Vulnerability handling

  • Report security issues to [email protected]. Please give the affected page and steps to reproduce and do not include customer data.
  • We acknowledge within 2 business days, fix confirmed issues by shipping a Forge update, and tell affected customers and Atlassian when an incident requires it.
  • Dependencies are checked with an audit before each public release.

Limits

RequestOps is not a SIEM, an identity system, a legal-hold system or a tamper-proof archive, and it holds no compliance certification. It relies on Atlassian’s platform security for hosting and storage.