Security policy

Last updated 2026-10-27. This policy covers Afterbrief (the Forge app for Jira and Confluence), the optional Afterbrief Relay that brings Slack messages into it, and this website. How personal data is handled is in the privacy policy.

Reporting a security issue

Email security@afterbrief.pro with what you found and how to reproduce it. We reply on working days (Monday to Friday, Central European Time), usually within one, and keep you updated until it is fixed.

Please give us a reasonable time to fix an issue before disclosing it, test only against your own site and workspace, and don't access, change or delete data that isn't yours. We won't take action against anyone who reports an issue in good faith and follows these rules.

The app runs only on Atlassian

Afterbrief is built on Atlassian Forge and runs only on Atlassian's compute and storage. It makes no calls to any service outside Atlassian, which is why it is eligible for Atlassian's Runs on Atlassian programme.

• Your data stays in your site. Incidents, timelines, postmortems and settings are held in your Atlassian site's storage for the app and on your Jira work items and Confluence pages, under your site's data residency. We have no access to them.
• Least privilege. The app asks only for the permissions its features need, and each one is explained in the listing. Jira comments on the timeline are read with each viewer's own permissions and never copied, so a comment restricted or deleted later disappears from the timeline too.
• AI stays on Atlassian. Draft with AI uses models hosted by Atlassian through Forge LLMs. It runs only when someone presses the button, sends only what that person can see, and nothing is used to train models.
• Inbound requests are signed. Slack messages reach the app through a single fixed Forge web trigger. Every request must carry a valid signature and a recent timestamp, and can only touch a work item that is already a declared incident, optionally limited to the spaces an admin allows.
• Secrets are write-only. The shared secret that signs relay requests is stored as a Forge secret; the settings page can say whether it is set, never show it.

The Slack relay

The relay at relay.afterbrief.pro is used only if you connect Slack. We run it on our own server at Hetzner in the European Union.

• No message content is stored. Messages are held in memory for a few seconds to be batched and delivered to your site, then discarded. Logs carry ids and counts, never message text.
• Encryption. Traffic is HTTPS only. Slack tokens and signing secrets are encrypted in the database (AES-256-GCM), and the database, its backups and logs sit on an encrypted volume (LUKS2).
• Access. The server accepts only web traffic from the internet. Administration is over a private network with SSH keys only, by people bound to confidentiality. Logins, administrative commands and account changes are logged.
• Verified requests. Requests from Slack are checked against Slack's signature, and a Slack workspace can be linked to a Jira site only by the person who installed the app, within minutes of installing it.
• Deletion. Removing the app from Slack deletes that workspace's records at once. Uninstalling Afterbrief from your site deletes your records within about 31 days; backups roll over within 14 days after that.

How we build it

• Every change is checked automatically before release: tests, static security analysis, a scan for leaked credentials, and an audit of dependencies for known vulnerabilities. The dependency audit also runs weekly when nothing changes, and dependency updates are proposed automatically.
• Releases are tested end to end in a real Atlassian site before they reach customers, and what reaches customers is the same build that was tested.
• A vulnerability that affects Afterbrief is fixed and released as a priority, according to its severity.

If something goes wrong

If we learn of a security incident affecting your data, we investigate it straight away, contain it, and tell you without undue delay what happened, what it affects and what we are doing about it, as our terms commit us to. We also notify the data protection authority where the law requires. Incidents in Atlassian's platform are handled by Atlassian under your agreement with them.

Contact

Security: security@afterbrief.pro · Everything else: support.