Security Policy
Last Updated: January 24, 2025
This Security Policy outlines the security measures, protocols, and practices Agile Doyens, LLC (“adLLC,” “we,” “us,” or “our”) employs to ensure the security, integrity, and confidentiality of Customer Data that is uploaded to or accessed by our software, applications, or related services (“adLLC Products”). By implementing this policy, we aim to protect our customers from security risks and uphold their trust.
This Security Policy applies to adLLC Products purchased directly from us under our Customer Agreement or through the Atlassian Marketplace under our adLLC Products End User Agreement. Our Customer Agreement and our End User Agreement are referred to collectively in this Security Policy as the “Agreement.” Capitalized terms not defined in this Security Policy are defined in the Agreement or in the documents, policies, and agreements incorporated into the Agreement. If there is a conflict between the terms of this Security Policy and the Agreement, including any incorporated agreement, the terms of the Agreement control.
1. Security Measures in General
We support the latest technical and organizational measures to protect your Customer Data. These measures are updated regularly to stay current. Despite these security measures, security gaps are possible when transmitting data on the Internet, and it is impossible to ensure complete data protection from unauthorized or malicious access by third parties.
2. Data Collection and Storage
We collect only the Customer Data necessary for the operation and enhancement of adLLC Products. This includes information required to provide core functionality and improve user experience. All collected data is securely stored using industry-standard encryption techniques. Specifically, data at rest is encrypted using AES-256, while data in transit is protected with TLS 1.2 or higher to prevent unauthorized interception.
Sensitive information is carefully handled to ensure it is never logged, stored, or transmitted unnecessarily. Our data handling practices are regularly reviewed and updated to align with evolving security standards.
Cloud-based adLLC Products store Related Data resulting from the user’s use of the service and is distinguished from Customer Data. This includes, for example, the use of statistics of service functions such as the total number of API calls per day. This data is anonymized and we cannot identify the end user this data relates to. It is exclusively used to improve our service and does not contain any Customer Data.
3. Support Requests
While adLLC Products are designed to access and store the minimal amount of Customer Data necessary for them to operate for their intended purposes, we cannot control the type of Customer Data that you provide to our support team when making requests for support services through adLLC Products. Customers are responsible for ensuring only the minimal amount of Customer Data and related information as necessary with our support team when making support requests.
4. Access Control
Access to Customer Data is strictly limited to authorized personnel who require it to perform their job functions. We enforce the principle of least privilege (PoLP) to ensure that employees and systems have the minimal access necessary to complete their tasks. Role-based access control (RBAC) is implemented to manage and assign permissions effectively. Access to Customer Data is logged and subject to regular audits. These measures help us identify and mitigate potential risks proactively. Our employees and any subcontractors from our support and development teams who have or may have access to Customer Data are contractually bound to confidentiality, privacy, and data security standards.
5. Secure Development Practices
Our development process incorporates robust security measures at every stage of the software development lifecycle. All code undergoes rigorous review to identify and address potential vulnerabilities. We adhere to industry-standard guidelines and best practices to mitigate common security risks, such as injection attacks.
User Authentication
Some adLLC Products provide application programming interfaces (APIs) that connect adLLC Products to other products offered by third parties, such as Jira® by Atlassian® or Clarity™ by Broadcom®. We do not store user email addresses and always retrieve current user data at the time of use using the applicable APIs. We share email addresses only with the SMTP server as required to provide the service to the end user. Multi-factor authentication (MFA) is strongly encouraged for all users to add protection against unauthorized access.
6. Session Management
Session management is a critical component of adLLC Products’ security strategy to ensure that users’ sessions are secure and protected from unauthorized access. User sessions are managed using secure token-based authentication mechanisms, such as JSON Web Tokens (JWT). These tokens are generated upon successful authentication and are securely encrypted to prevent tampering or interception.
To further enhance session security, we implement token expiration policies that require users to re-authenticate after a specific period of inactivity or when the session duration reaches its limit. This reduces the risk of unauthorized access due to prolonged or forgotten sessions.
Automatic logout mechanisms are in place to terminate idle sessions after a predefined time to protect against session hijacking. Additionally, users can manually log out, and any existing tokens are immediately invalidated.
All session-related data is stored securely, and session activity logs are maintained to detect and respond to unusual or unauthorized behaviors. These measures collectively ensure that session management is robust, providing a secure and seamless user experience.
7. Data Backups
We maintain regular backups of all critical data to ensure availability and recoverability in case of system failures, data corruption, or security incidents. Backups are performed daily at the end of the day and stored in secure locations to protect against physical and cyber threats.
All backup data is encrypted in transit and at rest to prevent unauthorized access. Access to backup storage is restricted to authorized personnel, and access logs are reviewed regularly to detect any unauthorized activities. Backup integrity is tested periodically through restoration exercises to verify that data can be successfully recovered without loss or corruption. In the event of a data loss incident, our recovery protocols are designed to restore operations quickly, minimizing downtime and impact on users.
8. Incident Response Plan
Our Incident Response Plan (IRP) outlines a structured approach to addressing security incidents effectively. When a potential incident is detected, our response team investigates and mitigates the issue promptly to minimize impact. Customers are notified of any confirmed data breaches as required by applicable laws. This notification includes details about the nature of the breach, the data affected, and steps being taken to address the issue. After resolving an incident, we conduct a thorough post-incident review to identify the root cause and implement measures to prevent recurrence.
9. Amazon Web Services
We utilize Heroku® by Salesforce® hosted by Amazon Web Services® (AWS) to store and process Customer Data for our cloud-based applications in Amazon.com, Inc.’s secure data centers in the United States. Heroku manages the security of the cloud. Heroku has been certified by third-party organizations and manages many compliance programs to comply with laws and regulations. A list of such certifications and compliance statements can be found here. By using AWS, we benefit from a robust and secure infrastructure that allows us to focus on delivering high-quality applications while ensuring data protection and compliance with global security standards. AWS provides a secure, reliable, and scalable infrastructure that meets industry-leading security standards, including ISO 27001, SOC 1, SOC 2, and SOC 3 compliance. Customer data stored in AWS is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. AWS’s built-in security features, such as Identity and Access Management (IAM), enable us to enforce strict access controls and monitor all access attempts.
To further protect Customer Data, we leverage AWS security tools for logging and monitoring, Distributed Denial of Service (DDoS) protection, and encryption key management. These measures ensure Customer Data is safeguarded against unauthorized access and cyber threats.
Status information about the AWS platform can be found here: https://status.aws.amazon.com/
Amazon has published security statements that can be found at the following link: https://aws.amazon.com/security/
10. Additional Terms for TIK for Jira™
We use the Atlassian Connect framework created and maintained by Atlassian to integrate TIK for Jira with Atlassian cloud products. This provides an additional layer of security and separates our apps from sensitive data stored on the Atlassian side (such as passwords and payment details).
For adLLC Products purchased on the Atlassian Marketplace®, we support Atlassian’s authentication mechanisms, including OAuth 2.0 and OpenID Connect, to ensure secure integration with user Atlassian accounts.
We prioritize vulnerabilities based on severity and address them within the timelines specified by Atlassian’s Security Bug Fix Policy. To further enhance our security posture, we adhere to the Atlassian Marketplace Bug Bounty Program for any adLLC Products purchased or available on the Atlassian Marketplace. The Marketplace Bug Bounty Program encourages responsible disclosure of vulnerabilities. This program allows ethical hackers to report security issues, which we promptly investigate and resolve.
adLLC is certified as a Cloud Security Compliant vendor with Atlassian. You can learn more about Atlassian’s Marketplace Apps Trust programs here.