The Jira suite that never leaves your instance.

Not yet. All seven modules — charts & dashboards, time tracking, budgets, diagramming, workflow automation, email handling and Workforce Intelligence — are built and running in our own test Jira site, but the Marketplace listing isn't live. The demos above are real working software running on generated data, so you can judge the products before committing anything. Join the list and you'll hear the day early access opens.

The app runs on Atlassian Forge. Code executes on Atlassian's compute and data is written to storage inside Atlassian's boundary. There is no Bastion Helix server in the path — we could not read your issues or your hours if we wanted to. That's what Atlassian's Runs on Atlassian designation certifies, and the app is built to meet its requirements from the first release.

Yes, on day one — it's the feature that makes switching possible at all. Export your logged time from Tempo as a CSV and import it on the app's admin page once the app's first sync of your worklogs has finished. Accounts, billable flags and work categories are matched onto the Jira worklogs Tempo created, and hours with no Jira worklog behind them are kept as read-only history with their dates, people and descriptions. It works from the export rather than Tempo's API, because calling Tempo's servers would mean your data leaving Atlassian.

Yes. Import a .drawio file into any project and it opens as an editable diagram, and any diagram can be exported back to .drawio whenever you like, so nothing is locked in. Import reads uncompressed .drawio files, which is what recent versions of draw.io save by default; for an older compressed file, untick Compressed under File → Properties in draw.io first.

From the hours logged in Jira. Each worklog is priced at the hourly rate that applied on the day the work happened — the person's own rate first, then the project's, then the site-wide default. Cost is never stored, so correcting a rate reprices the work it covers. Only Jira administrators can set rates, and cost per person appears only for budget owners who are allowed to see those people's hours.

Jira's API is too slow to draw charts from directly, so the app keeps a copy of your issues in Forge storage, refreshed every hour, and of your worklogs, refreshed every five minutes because they change more often. Charts read up to the 10,000 most recently created issues from that copy rather than asking Jira each time. Every serious app in this space keeps a copy — the difference is where the copy lives.

Issue data is limited to the projects the viewer can browse, and hours follow their own rule: you see your own, project admins see hours in their projects, approvers see the people they approve, and Jira admins see everyone's. Where an approver can't open an issue, its hours show as one anonymous line. Projects where issues carry a security level are answered by a live query run as that user.

You shouldn't, on faith. What you can check: the app asks to read your Jira work and the names of the people in it, and for write access to Jira work. It writes in three ways: the worklogs you log through it, the issues, comments and attachments your email channels create, and whatever your own automation rules do — transitions, comments, fields, labels, links, new issues. Jira records every one of those as Bastion Helix, and the rule's history or the channel's mail log says why, so nothing it does is anonymous. It never deletes an issue — nothing in its code does, though Jira's permission to write work would technically allow it — and it has no way to send anything to a site other than Atlassian. It stores nothing outside Atlassian, and can be uninstalled in one click, after which its stored data is deleted under Atlassian's retention policy. The architecture is the argument, not the logo.

Your own mail routing forwards it. Point Cloudflare Email Routing, Postmark, SendGrid, Mailgun — or anything that can make an HTTPS request — at a channel's private address, and each message becomes an issue, or a comment when it answers an earlier one. The app never holds a mailbox and never sends email; people in Jira are notified the way Jira always notifies them.

Your tools send the data in; the app never calls out. Claude Code reports its own usage over OpenTelemetry, GitHub posts commits and pull requests by webhook, and a small script you run in your own GitHub Actions reads your Anthropic and OpenAI billing with admin keys that never reach the app. Spend from a vendor's bill is shown as spend; where only an estimate exists, it is marked as one. The billing script is still being tested against live Anthropic and OpenAI accounts. Only Jira administrators, and the people they name, can see any of it.

An independent developer. Small enough that support goes straight to the person who wrote the code, which is the one advantage a new vendor genuinely has over a large one.