← Back to MigrationMonitor

Privacy Policy

MigrationMonitor · Effective Date: September 2026 · Developer: Appcento (David Day)

Overview

MigrationMonitor ("the App") is an Atlassian Forge app that provides real-time monitoring and validation for Jira Data Center to Cloud migrations.

This Privacy Policy describes how the App handles data when installed on your Atlassian Jira Cloud site.

Data Collection and Storage

The App does not collect, store, or transmit any personal data outside of your Atlassian Jira Cloud site.

The App runs entirely on the Atlassian Forge platform ("Runs on Atlassian"). All processing occurs within Atlassian's infrastructure. The App does not have any external servers, databases, or third-party service integrations.

What the App accesses

  • Jira instance metadata: Project configurations, workflows, screens, and custom field definitions for migration readiness checks. Read from /rest/api/3/field/search, /rest/api/3/workflow/search, /rest/api/3/project/search, and /rest/api/3/permissionscheme.
  • Account data: Account IDs, display names, and email addresses from /rest/api/3/user/search, used only to group duplicate and stale accounts.

The app calls exactly these five Jira REST endpoints and no others. It does not call the Migration API and does not read JCMA migration logs or migration event data.

What the App does NOT access

  • Issue content (summaries, descriptions, comments, attachments)
  • JCMA migration logs or migration event data
  • Any data outside the scope of migration readiness analysis

Account identifiers are accessed in one place only: the duplicate-account report, which reads account IDs, display names, and email addresses from /rest/api/3/user/search so that duplicate and stale accounts can be grouped. These values are stored in Atlassian KVS inside your site and are never sent outside it.

Data Processing

All data processing happens within the Atlassian Forge runtime:

  • Monitoring: The App reads Jira metadata and issue data to track migration readiness. No data leaves Atlassian's infrastructure.
  • Validation: The App compares pre-migration and post-migration configurations to identify discrepancies. All operations use Jira's REST API through Forge's built-in OAuth mechanism.

Data Storage and Retention

Migration monitoring data is stored in Atlassian Key-Value Store (KVS) within your Jira Cloud instance under the storage:app scope. There is no application database and no external datastore. Snapshots persist until you remove them: use Clear History to delete all stored snapshots, and uninstalling the App deletes all stored data. The App does not automatically expire or archive snapshots on a schedule.

Data Sharing

The App keeps your data inside your Jira Cloud instance:

  • The App does not share data with third parties.
  • The App does not use data for advertising or analytics.
  • The App does not sell or license data to other organisations.
  • Export reports are rendered client-side and never leave your Jira Cloud instance.

Egress

Jira API calls go only to Atlassian endpoints (api.atlassian.com and *.atlassian.net) declared in the app manifest, along with *.cdn.prod.atlassian-dev.net, which is used to load the App's frontend assets. The optional change-alert feature can post to a Slack or Microsoft Teams webhook URL that you supply; the target is validated against a provider allowlist and requires HTTPS. This path is currently disabled in the user interface and no external destination is declared in the manifest, so no request leaves Atlassian infrastructure in version 2.4.0.

Compliance

The App is built on Atlassian Forge and inherits the Forge platform's controls:

  • The App uses Jira data in a read-only way. It creates, edits, and deletes no Jira issues, projects, or configuration.
  • Storage writes are limited to the App's own KVS records.
  • The App is designed to support GDPR obligations for installed instances. Atlassian acts as processor for data held in your Jira Cloud site.
  • Appcento LLC does not hold an independent SOC 2 or ISO 27001 attestation. SOC 2 status for this App derives solely from Atlassian's Forge platform.

Atlassian Forge Platform

The App is built on and hosted by the Atlassian Forge platform. By using the App, your data is subject to Atlassian's own data handling practices as described in:

Permissions (Scopes)

Scope Purpose
read:jira-work Read custom fields and project metadata for readiness scoring
manage:jira-configuration Read published workflows, which requires this scope
read:jira-user Read account profiles for the duplicate-account report
manage:jira-project Read permission schemes and workflow-to-project associations
storage:app Store scan snapshots in Atlassian KVS in your Jira Cloud instance

These five scopes match the app manifest exactly. All Jira API requests are read-only, and every request runs under the identity of the user who triggered it so Jira applies that user's own permissions.

User Rights

You have full control over your data:

  • Clear History: Use the "Clear History" feature in App settings to delete all stored monitoring data at any time.
  • Uninstall: Uninstalling the App from your Jira Cloud instance automatically deletes all stored data.
  • Data Portability: Export your monitoring data at any time through the App's export feature.

Children's Privacy

The App is not directed to individuals under 13. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will take effect by updating the "Effective Date" at the top of this document. Continued use of the App after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this Privacy Policy or the App's data practices, contact us at:

Email: [email protected]
Website: https://appcento.com

MigrationMonitor · Privacy Policy · Terms of Service · Security Policy · Contact