Security Policy

This policy covers every app made by YTI Digital OÜ (Estonia): our apps on the Atlassian Marketplace (Jira and Confluence), on the Shopify App Store and on the HubSpot App Marketplace, and the servers that support them. Each app's documentation also has a Permissions and data page that lists exactly what that app reads, what it stores and where it sends it.

Reporting a vulnerability

• Email support@yti.digital with "Security" in the subject. Include the app, the steps to reproduce and what an attacker could do. Please don't test against other customers' data or degrade the service.
• We acknowledge every report within 2 business days and keep you informed until it is resolved.
• We don't take legal action against good-faith research that follows this policy, and we credit reporters who want to be named once a fix is out.

Vulnerability management

• Triage: each report or advisory is reproduced and rated by impact (critical, high, medium, low) on the data and accounts it could expose.
• Fix times: critical issues are fixed or mitigated within 7 days, high within 30 days, the rest in the next regular release.
• Dependencies: versions are pinned, and we check them against published security advisories before each release and when an advisory affects a package we use.
• Releases: every change goes through automated tests before it is deployed. Atlassian apps are deployed through Atlassian Forge, so customers receive fixes without having to do anything.

Security incidents

• Detection: our servers and app endpoints are monitored around the clock; failures and unusual errors raise alerts to the team.
• Response: we contain the incident first (for example by revoking keys or disabling the affected function), then investigate, fix the cause and restore normal service.
• Communication: if an incident affects customer data, we inform the affected customers without undue delay and within 72 hours of confirming it, saying what happened, what data was involved and what we are doing. For Atlassian apps we also notify Atlassian through its partner channels, as the Marketplace Partner Agreement requires.
• Afterwards: we record what happened and change the process or code so the same incident can't happen again.

Security controls

• Least privilege: each app asks only for the platform permissions its features need, and acts as the signed-in user wherever the platform allows it, so the platform's own permissions decide what a person may see or change.
• Atlassian apps are built on Atlassian Forge. Data they keep is stored in Atlassian's infrastructure (Forge storage, Jira and Confluence properties), and apps marked "Runs on Atlassian" send no data outside it. Apps that connect to another service (for example a chat tool or a CRM) say so on their listing and in their documentation; secrets such as a customer's API token are kept in Forge's encrypted secret storage.
• Our own servers (used by our Shopify and HubSpot apps) run in data centres in Germany (Hetzner). All traffic uses HTTPS (TLS). Access tokens and sensitive fields are encrypted at rest with AES-256-GCM, with the key kept outside the database. Server access is limited to the founder, over SSH with keys only.
• Signed requests: webhooks and calls from the platforms are verified with the platform's signature before they are processed.
• Logging: technical logs are kept short and scrubbed of tokens and secrets; we don't log message bodies or customer content.
• Data minimisation and deletion: we store only what a feature needs, and delete a customer's data after uninstall as described in each app's documentation.

Contact

Security questions and reports: support@yti.digital. Personal data questions: see our Privacy Policy.