Business Sign-off & Approval for Jira
This policy covers personal and customer data handled in connection with installing, operating, supporting, licensing, and using Business Sign-off & Approval for Jira Cloud (“Business Sign-off” or the “App”), including product-related information received directly by Cahaba Forge. It does not govern visits to the Cahaba Forge corporate website or general marketing activities.
The App runs on Atlassian’s Forge platform. App-managed approval data is processed and stored within Atlassian’s infrastructure using Forge-hosted storage and Jira Cloud. Cahaba Forge does not operate an external backend for the App, and the App is not configured to send approval data to services outside Atlassian’s infrastructure. Developer access to platform-hosted logs and usage measurements is described in Section 9.
Product support correspondence and Marketplace information received directly by Cahaba Forge are described in Section 13. The App’s Atlassian-hosted processing description does not apply to information you send directly to Cahaba Forge for product support.
In the event of any conflict between this Privacy Policy and the Cahaba Forge Data Processing Addendum (DPA) with respect to the processing of Personal Data on behalf of a Licensee, the DPA shall control.
The App accesses Jira data needed to provide approval workflows:
Some of this information is used only during a request; identifiers, display names, and issue context are also retained in the approval and audit records described below.
Email addresses: Email addresses available from Jira may be read at runtime for issue-panel display. The App does not persist user email addresses in its app-managed data stores or audit records. Jira controls the availability of email addresses and the delivery of Jira notifications.
| Category | Data and purpose |
|---|---|
| Approver assignments and decisions | Issue and account identifiers; assignment and decision status; who assigned the approver; assignment, decision, and notification times; decision comments; and relevant issue status and Separation of Duties outcomes. Used to manage approvals, enforce configured rules, and show decision progress. |
| Approval history | Approval-related actions and times; participating users’ account identifiers and display-name snapshots; issue and project identifiers; issue summaries, types, priorities, statuses, reporter and assignee context; before-and-after approval outcomes; decision comments; and audit-integrity and privacy-action information. Used for accountability and compliance reporting. |
| Administrative audit records | Administrative actions and times; the acting user’s account identifier and display-name snapshot; affected settings and projects; changed values; relevant action context; and audit-integrity and privacy-action information. Used for administrative accountability. |
| Global and project settings | Feature settings, thresholds, permission and eligibility rules, Separation of Duties rules, comment requirements, decision locking, panel visibility, issue-type filtering, notification preferences, and diagnostic logging settings. Eligibility and permission rules reference configured groups and roles. |
| Temporary export information | The requesting administrator’s account identifier; export criteria, times, status and outcome; and generated CSV content. Used to prepare and deliver audit exports. Exported content can contain the personal data present in audit records. |
| Account lifecycle information | Account identifiers and information about when the App handled data for those accounts, used for Atlassian personal-data reporting and closed-account handling. |
| Operational logs and feature-use measurements | Troubleshooting information and numeric counts of feature use, as explained in Section 9. |
Decision comments are free text. Issue summaries, configuration values, and other contextual text may also contain information supplied by customers. Customers should consider the information they enter and their own data-handling requirements.
Account identifiers and historical names: Atlassian account IDs identify users and are treated as personal data in this policy. Historical display names are retained as point-in-time audit snapshots; later profile changes do not automatically change those snapshots. Account closure is handled separately under Sections 2 and 4.
The App writes the following native Jira data in addition to its Forge-hosted records:
Native Jira data is governed by Jira access controls and persists independently of the App. Uninstalling the App does not remove these custom-field values or issue audit records.
Atlassian manages Marketplace licensing. The App uses license status to determine whether licensed operations are available; it does not store license keys or licensing-related personal data in its app-managed records. Marketplace information received directly by Cahaba Forge is covered separately in Section 13.
The App processes information to:
The App reports stored account identifiers and associated timestamps through Atlassian’s personal-data reporting service. This allows Atlassian to identify closed accounts and profile updates. The reporting payload does not include display names, email addresses, or decision comments.
When Atlassian reports an account as closed, the App attempts to replace that user’s stored display-name references with “Deleted user” and clear decision comments authored by that user in the approval and audit records it processes. Underlying records and account identifiers remain to preserve audit continuity. This is pseudonymization, not full deletion or a guarantee of anonymization.
A profile update does not automatically revise historical audit snapshots. Current, non-historical user information is obtained from Jira.
Account-closure processing is not immediate, and processing failures or incomplete coverage may require support follow-up. Closing an Atlassian account should not be treated as a guarantee that all copies of information about that person have been deleted. Customer-downloaded exports and Jira-managed data must also be considered when responding to a privacy request.
Approval records and configuration are stored in Forge-hosted storage and Jira Cloud. Atlassian manages the hosting infrastructure, encryption at rest and in transit, and installation-level storage isolation. See Atlassian Trust.
Forge-hosted storage follows Atlassian’s data residency model for the host product. This does not mean every platform service, operational log, or usage measurement is guaranteed to be processed in the same region as your Jira site. International transfers are subject to Atlassian’s applicable data residency and transfer policies.
Atlassian manages platform backup and recovery. Platform backups should not be treated as a customer-accessible App restore feature or a promise that all App information is included in a Jira backup. Uninstall and reinstallation are addressed in Section 4.
Jira permissions and App administration controls govern customer access. Customers are responsible for their Jira access settings, the information entered into approval workflows, and downloaded exports.
Automatic App cleanup depends on successful processing. It should not be interpreted as an instantaneous or unconditional deletion guarantee; contact Cahaba Forge if you need help verifying a deletion or responding to a privacy request.
Uninstalling the App does not immediately erase all data held by Atlassian. Atlassian’s current Forge-hosted storage documentation states that hosted App data is retained for 28 days after uninstall and is not automatically restored when an app is reinstalled.
Any platform-assisted recovery is subject to Atlassian’s process, customer consent, and applicable time limits. This policy does not promise successful recovery, automatic restoration, or re-ingestion of native Jira audit records after reinstall. Contact Cahaba Forge promptly if recovery is needed.
Native Jira custom-field values and issue audit records remain after uninstall and need separate customer management. Uninstall should not be used as a promise of immediate, complete erasure for a data-subject request.
The App does not use an external Cahaba Forge backend or an external third-party service to process approval data. Its configured application processing, account lifecycle reporting, logs, and feature-use counters use Atlassian’s infrastructure.
Authorized Cahaba Forge app developers can access platform-hosted logs and usage measurements subject to Atlassian’s access controls. This is distinct from having direct access to your Jira site or browsing its approval records. Information you submit in a support request is handled under Section 13.
Atlassian has access to platform data under its Privacy Policy and Cloud Terms of Service.
Cahaba Forge does not use Licensee data, Data Subject information, approval decisions, or audit records for training, tuning, fine-tuning, or evaluating any artificial intelligence or machine learning models. The App does not employ AI or ML in any form. Cahaba Forge does not make Licensee data available to any third party for AI or ML purposes.
The App does not add advertising trackers, web beacons, tracking pixels, or browser fingerprinting. The App’s own code does not set or read browser cookies for tracking or load Google Analytics or other external analytics scripts. Atlassian’s own Jira and platform practices are governed by Atlassian’s policies.
The App does include Forge-native feature-use counters described in Section 9.
Users can view approval assignments and decision history through the issue panel, subject to Jira and App permissions. Authorized administrators can review approval history and administrative audit information and use CSV audit exports with project and date filters.
A Jira administrator can request an account-based privacy report summarizing stored approver, approval-history, and administrative audit records and associated issue references. The report is a summary of counts and references, not a copy of every underlying record or a guarantee that it covers every data category. Audit CSV exports provide supported audit content for review. The privacy-report operation remains available without an active App license.
Data Subjects should contact the organization operating their Jira site (the Licensee), which is responsible for responding to requests about App data. Cahaba Forge will assist the Licensee using the supported App capabilities and the applicable DPA. Privacy questions and unresolved requests can be sent to privacy@cahabaforge.com.
a) Data Controller: You (the Licensee) are the data controller for all personal data processed by the App within your Jira Cloud site.
b) Data Processor / Sub-Processor: Cahaba Forge LLC is the data processor. The App runs in Atlassian’s Forge infrastructure; Cahaba Forge does not host an external App data store. Atlassian acts as a sub-processor for infrastructure, hosting, and data storage. Developer access to logs and measurements is described in Section 9.
c) Legal Basis for Processing: The legal basis for Cahaba Forge’s processing is performance of its contract with Licensee (GDPR Article 6(1)(b)) and compliance with its obligations as a processor under GDPR Article 28. The legal basis for the underlying processing of Data Subject information is determined by Licensee as Controller, typically legitimate interests in maintaining compliance audit trails and approval workflow integrity (Article 6(1)(f)), or legal obligation where compliance with laws such as SOX is applicable (Article 6(1)(c)). Applicable compliance requirements such as SOC 2 or equivalent frameworks are distinct from legal obligations. Licensee is responsible for ensuring an appropriate legal basis exists for its processing activities.
d) Personal Data Processed: The categories in Section 1 include account identifiers, display-name snapshots, issue and action context, comments, and export information. Email addresses may be read at runtime but are not persisted by the App.
e) Retention: The categories, deletion behavior, and material limitations are described in Section 4.
f) Data Subject Rights: The Licensee is responsible for fulfilling access, erasure, rectification, and portability requests. App exports and privacy controls assist with these requests; their limitations are described above.
g) Sub-Processors: Atlassian Pty Ltd provides the Forge platform and Jira Cloud infrastructure. No other sub-processors are used for the App’s configured approval-data processing. Product-related support and licensing services are described in Section 13.
h) International Transfers: App data resides in Atlassian’s infrastructure and is subject to Atlassian’s applicable data residency and international transfer policies.
A Data Processing Addendum (DPA) is available for customers requiring GDPR compliance documentation. To request a signed copy, contact privacy@cahabaforge.com.
For Licensees and Data Subjects subject to the California Consumer Privacy Act of 2018 as amended (“CCPA”):
For detailed CCPA terms, see the Cahaba Forge Data Processing Addendum.
Standard operational logs are active for errors and warnings. An administrator can also enable additional diagnostic logging for a configured period of 1–8 hours. Logging can contain account identifiers and issue identifiers used for troubleshooting, including information about account-closure processing.
Authorized App developers can access logs through Atlassian’s Developer Console, subject to the platform’s controls. Logs are retained under Atlassian’s logging policies. The diagnostic duration stops additional diagnostic logging; it does not mean previously collected logs are deleted within 1–8 hours.
The App records numeric counts of feature use, such as approval decisions, approver assignments, notifications, dashboard use, project enablement, licensing-related blocked actions, and audit exports. These measurements are processed through Atlassian’s Forge metrics service rather than an external analytics provider.
The App’s counter submissions consist of feature labels and numeric increments. They do not add user account IDs, display names, email addresses, issue identifiers, decision comments, or audit-record contents to the counter payload.
Atlassian’s custom metrics documentation describes developer visibility and site-level filtering, and administrator controls over custom metrics access. These counters should not be understood as a guarantee that platform measurements are anonymous or cannot be associated with an installation. Platform metadata, retention, and access are governed by Atlassian’s service.
Business Sign-off is enterprise software designed for use in organizational settings. It is not intended for use by individuals under the age of 16 (or such younger age as permitted by applicable law). The App does not knowingly collect data from children.
We may update this privacy policy to reflect changes in the App’s data handling practices. Material changes will be communicated with at least thirty (30) days’ prior notice through the Cahaba Forge website and/or email notification. The “Last Updated” date at the top of this document indicates when the policy was last revised.
For privacy-related questions or concerns:
In addition to Personal Data processed by the App on behalf of Licensees, Cahaba Forge acts as a controller for information it receives directly to support and provide Business Sign-off & Approval for Jira Cloud. This section covers product-related support, inquiries, and Marketplace licensing information.
When you contact Cahaba Forge about Business Sign-off & Approval for Jira Cloud, we receive the name, email address, and message content you provide. We use this information solely to respond to your inquiry and maintain records of support interactions. Correspondence is retained for no longer than reasonably necessary for support and recordkeeping purposes.
If you send an export, screenshot, or other customer information with a request, that information is included in the correspondence you provide directly; the App’s Atlassian-only processing description does not apply to that submission.
Atlassian shares limited Marketplace transaction information about Business Sign-off & Approval for Jira Cloud with Cahaba Forge, such as license records and the Licensee’s technical contact details. Cahaba Forge uses this information only to fulfill its obligations under the Agreement.
Cahaba Forge does not sell, rent, or share directly collected product-related information with third parties except as necessary to provide and support the product, such as email service providers used for product correspondence, or as required by law.
For requests concerning product-related information received directly by Cahaba Forge, contact privacy@cahabaforge.com. Requests concerning your organization’s App data should be directed to the Licensee, as described in Section 7.