1. Scope and parties
This Data Processing Addendum ("DPA") applies when a customer ("you") installs Bastion Helix for Jira ("the app") through the Atlassian Marketplace. It forms part of the end user agreement under which you use the app, and it applies to personal data the app processes for you ("Customer Personal Data").
"We" means Bastion Helix, an independent developer based in Bengaluru, India. Contact: support@bastionhelix.com.
Where this DPA and the end user agreement disagree about personal data, this DPA applies.
2. Roles
- GDPR (and UK GDPR): you are the controller of Customer Personal Data, and we are your processor.
- CCPA: you are the business and we are your service provider. We do not sell or share Customer Personal Data, and we do not retain, use or disclose it for any purpose other than providing the app to you, or combine it with personal data from other sources.
- For the licensing contacts Atlassian shares with us and for messages you send to support, we act as an independent controller, as set out in our privacy policy. Those are not covered by this DPA.
3. What the app processes
| Item | Details |
|---|---|
| Purpose | Providing the app's features to your Jira site: charts and dashboards, time tracking, budgets, diagrams, workflow automation, email-to-issue and Workforce Intelligence. |
| Nature | Copying, storing, organising, combining and displaying data inside your Jira site, and writing to Jira when your users or your own rules ask the app to. |
| People concerned | Users of your Jira site; people who send email to channels you set up; people whose AI usage, commits and pull requests your own tools send to the app. |
| Data | Atlassian account IDs and display names; email addresses of email-to-issue senders and AI usage contributors; issue, worklog and timesheet data; content of emails turned into issues or comments; AI usage records and GitHub commit and pull request details. |
| Special categories | None are required. Please don't use the app to process them. |
| Duration | For as long as the app is installed on your site, then until Atlassian deletes the app's storage (section 9). |
4. Your instructions
We process Customer Personal Data only on your documented instructions. Your instructions are the end user agreement, this DPA, and the way your administrators and users configure and use the app. If we believe an instruction breaks data protection law, we will tell you.
5. Where the data lives, and who can access it
The app is built on Atlassian Forge. Its code runs on Atlassian's infrastructure, and all Customer Personal Data is stored in Forge hosted storage inside Atlassian. There is no Bastion Helix server, and the app sends nothing outside Atlassian.
We have no technical access to Customer Personal Data stored by the app, and the app gives us none. People who can see data in the app are the users of your own Jira site, according to the permission rules in the documentation.
6. Security
We use the following measures, and keep them appropriate to the risk:
- Hosting, storage, encryption at rest and separation between customer sites are provided by Atlassian Forge.
- The app asks only for the Jira permissions it uses (listed in the documentation). Issue data is limited to what each viewer can browse in Jira, and hours, rates and AI usage follow their own visibility rules.
- Incoming email and Workforce Intelligence data are accepted only with a random token the app generates, which an administrator can replace at any time. GitHub deliveries are also checked with an HMAC signature.
- Two-step sign-in is required on the GitHub organisation that holds the app's source code, and the source code is private.
- Every change is tested before release, and releases reach your site through Atlassian.
7. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Atlassian Pty Ltd and its affiliates | Running the app and storing its data (Atlassian Forge) | Follows your Jira site's data residency |
Atlassian's own sub-processors are listed by Atlassian. You authorise us to use the sub-processors in this table. We will update this page at least 30 days before adding a new one. If you object, you can stop using the app and uninstall it.
8. Helping you with requests and obligations
- People's requests (access, correction, deletion): Customer Personal Data lives in your Jira site, so your administrators can find, correct and delete it in the app. If you need more help, email us and we will assist.
- Closed accounts: as Atlassian requires, the app reports the accounts it holds data about each week. When Atlassian says an account is closed, the app erases that person's ID and name from its storage.
- Assessments: we will give you the information you reasonably need for a data protection impact assessment or a regulator's question about the app.
9. Breaches, and deletion at the end
Breaches: if we become aware of a breach of security affecting Customer Personal Data, we will tell you without undue delay, and no later than 72 hours after becoming aware of it, through your site's technical contact on the Marketplace. We will tell you what we know, what we are doing about it, and what you may need to do.
Deletion: when you uninstall the app, Atlassian deletes the app's storage for your site under its data retention policy for uninstalled apps. We hold no copy. Before uninstalling, you can export what you need from the app (for example charts as CSV and diagrams as .drawio). Worklogs, issues and comments the app wrote into Jira stay in Jira, because they are ordinary Jira data.
10. International transfers
Customer Personal Data stays in Atlassian's infrastructure, in the location your Jira site's data residency setting decides. The app does not transfer it to us or anywhere else.
11. Audits
Once a year, or after a breach, we will answer a reasonable written security questionnaire about the app. Because we run no servers and hold no Customer Personal Data, there are no premises or systems of ours to inspect. Atlassian's infrastructure is covered by Atlassian's own certifications and reports.
12. Changes and contact
We may update this DPA to reflect changes in the law or in how the app works. The current version is always on this page with its date. We will not reduce its protections for Customer Personal Data while you are using the app.
Questions: support@bastionhelix.com.