Partner Security Policy

1. Scope

ComTools (“we”, “us”) provides the Jira License Optimizer app on the Atlassian Marketplace. This page describes how we secure the app and related systems. It is not a privacy policy.

For data processing, retention, and customer rights, see our Privacy Policy. For product help, see Support.

2. How we handle security issues and incidents

A security incident includes unauthorized access, disclosure, alteration, or loss of customer data, or a confirmed vulnerability being exploited.

When we learn of an issue:

• Triage — confirm scope (Forge app vs related website), affected installations, and severity
• Contain — disable or patch the affected function; revoke compromised credentials if any
• Eradicate and recover — ship a Forge app update and verify the fix
• Notify — if customer data is reasonably believed to be affected, notify affected site admins and, where required, Atlassian through the partner security / AMS process
• Follow up — record the cause, the fix, and the preventive change

Billing is handled by Atlassian. We do not store payment card data.

3. Vulnerability management

Reporting

Email support@shinetechcd.online with the subject prefix [SECURITY]. We also review vulnerabilities filed through Atlassian Marketplace Security (AMS).

Please include:

• Your Atlassian site URL and environment (production / staging) if relevant
• A description, steps to reproduce, and expected impact
• Whether any data was accessed

Do not send exploit payloads or customer secrets in the first email. We aim to acknowledge reports within 1–2 business days (UTC+8).

Triage

We validate the report, score it (CVSS where applicable), and accept or reject it with a reason. Target triage time is 5 business days.

Remediation

Cloud app fix targets follow the Atlassian Marketplace Security Bug Fix Policy:

We prefer coordinated disclosure and do not publish exploit details until a fix is available or the risk is otherwise contained. Dependencies and Forge runtime updates are reviewed when we ship app versions.

4. Key security controls

Access control

• Users authenticate through Atlassian. The app does not store Atlassian passwords or personal access tokens
• The app uses the minimum Forge scopes required for seat analysis and administrator-initiated product access removal
• Product access removal runs as the current administrator and requires their Jira group-management permission
• Protected accounts and typed confirmation reduce accidental removals
• Vendor access to partner systems (Marketplace, Forge, email, source) is limited to people who need it, with multi-factor authentication where the platform supports it

Data protection

• The app runs on Atlassian Forge. Seat-analysis data is stored in Forge-hosted storage for each customer installation
• Encryption at rest and in transit, and data residency, follow Atlassian Cloud / Forge capabilities for the customer site
• We do not sell personal data and do not copy Jira directory data to ComTools servers for this app
• On uninstall, a best-effort preUninstall cleanup deletes cached seat analysis, settings, protected accounts, sync keys, and removal audit records
• Payment card data is not collected (billing is handled by Atlassian)

Monitoring

• We review security and support email, and Atlassian AMS tickets
• We investigate unexpected errors or customer reports that may indicate a security issue
• Administrator-initiated product access removals are recorded in an in-app audit trail (actor, target, outcome, timestamp, and affected groups)

5. Related systems

comtools.cn hosts this policy, support, and privacy pages. It is not the runtime for Jira License Optimizer and does not store that app’s Jira directory data. The website uses HTTPS.

6. Changes

We may update this policy. Material changes will be published on this page. The Marketplace Partner Security Policy link will remain pointed at this URL.