Every serious app keeps a copy
Jira's API is too slow to draw a chart over ten thousand issues on every page load, so reporting apps keep a copy of your issues and worklogs. That is not the problem. The question a security reviewer should ask is: where does the copy live? For most apps the answer is a database the vendor runs, in a cloud account the vendor controls.
Forge moves the copy inside
Atlassian Forge lets an app run its code on Atlassian's compute and keep its data in storage inside Atlassian's boundary. Bastion Helix is built entirely on Forge: its copy of your issues lives in Forge storage, refreshed every hour, and of your worklogs, refreshed every five minutes. There is no Bastion Helix server in the path. We could not read your issues or your hours if we wanted to.
Runs on Atlassian
Atlassian's Runs on Atlassian designation identifies Forge apps that don't send data outside Atlassian. Bastion Helix is built to meet its requirements from the first release. That shapes design decisions everywhere: the Tempo import reads a CSV you export rather than calling Tempo's servers; email arrives because your own mail routing forwards it; AI usage arrives because your own tools send it.
What changes in a review
- No new sub-processor. The data stays with Atlassian, whom you have already assessed.
- No vendor database to breach. There is nothing of yours on our side to leak.
- Uninstall is deletion. Remove the app and its stored data is deleted under Atlassian's retention policy.
- Every write is attributed. What the app changes in Jira is recorded as Bastion Helix, and nothing in its code deletes an issue.
The architecture is the argument, not the logo.
Bastion Helix for Jira isn’t on the Marketplace yet. All seven modules are built and running in our own test Jira site. Try the live demos, or leave your email below to hear the day early access opens.