1.Architecture: runs inside Atlassian
Smart Runbooks is built on Atlassian Forge. All application logic runs on Atlassian-managed infrastructure inside your Atlassian site — there are no Aheadnode servers and no external database. The only data store is Forge hosted storage, isolated per installation, so one customer's data is never co-located with another's at the application layer.
2.Data storage & encryption
Everything the app persists lives in Forge storage, encrypted at rest by Atlassian; all traffic is encrypted in transit (TLS 1.2+). The app deliberately stores very little: Atlassian account IDs (user preferences, template authors), the URLs of pages it has generated, and your configuration and templates. Ticket content is never stored by the app — generated documents are written directly into your own Confluence.
3.AI processing: one disclosed sub-processor
Document generation uses the Google Gemini API — our single AI sub-processor and the only service that receives End-User Data. Issue content is sent transiently at generation time, bounded before it leaves (recent comments and a capped description, not unbounded ticket history). Under the Gemini API terms, your content is not used to train models. Customers can bring their own Gemini key — processing then runs under your own Google agreement — or disable automatic generation entirely. Operational telemetry (logs, error reports) contains no End-User Data by design.
4.Access & authorization
Authentication is Atlassian's own — the app never sees or stores Atlassian passwords or tokens. Actions run with the requesting user's permissions wherever possible, and app-level publishing into a user-selected space is allowed only after verifying that user's own Confluence access. Jira Service Management (customer) tickets are routed to a private knowledge-base space so customer content cannot leak into internal or public spaces. Scopes follow least privilege.
5.Secure development
Every change reaches production through a pull request with a passing pipeline: linting, an automated test suite, full-history secret scanning (gitleaks), and dependency vulnerability auditing — on supply-chain-pinned CI images. Rendering uses Atlassian's UI Kit exclusively (no raw HTML), removing a whole class of injection surface. The codebase underwent an independent security audit in June 2026; all findings were fixed before our Marketplace submission.
6.Privacy & GDPR
The app implements Atlassian's personal-data reporting and erasure lifecycle: stored account IDs are reportable, and an Atlassian erasure event removes that user's data automatically. Full details — what is processed, what is stored, retention, and your rights — are in the Privacy Policy.
7.Incident response & vulnerability reporting
We maintain a documented incident-response plan covering detection, containment, and notification, and we follow the Atlassian Marketplace security bug-fix policy's remediation timelines. If an incident affects customer data, we notify Atlassian and affected customers.
Found a vulnerability? Email support@aheadnode.com with details and we will respond promptly. Please don't test against systems or data you don't own — see the site Terms of Use.
8.What we don't claim (yet)
We believe security pages should be honest, so: Aheadnode does not yet hold formal compliance certifications (ISO 27001, SOC 2), and independent penetration testing and Marketplace Bug Bounty participation are planned as the product grows. What is listed above is real, in production, and verifiable — and this page will only ever describe controls we actually have.
9.This website
aheadnode.com is a static site that sets no cookies and runs no analytics or tracking; fonts are self-hosted so no visitor data reaches third parties. It is served with a strict Content-Security-Policy and hardening headers over HTTPS.
10.Contact
Security questions or reports: support@aheadnode.com · privacy matters: privacy@aheadnode.com.