How operations are protected
- The user interface runs in Jira and the app functions run on Atlassian Forge.
- Server-side administrator checks supplement interface restrictions.
- Operations that require a license check its status.
- The app reads permissions and resource state before writing. Changes require a preview and explicit confirmation.
- Operational Forge storage is separated by installation and environment.
- Reports and plans have limited retention, with privacy and uninstall mechanisms.
External network access
Leaver Guard declares no external services in its app code. Broken Link Guard has separate, optional external link checks, disabled by default and limited to administrator-configured exact domains; its own documentation describes those conditions.
Report a vulnerability
Email support@noeapps.com with the subject “Security — NoeApps”. Include the version, steps to reproduce with synthetic data, expected impact, and a way to contact you. Do not access third-party data or publish confidential information.
Limits of these statements
NoeApps does not claim its own SOC 2 or ISO 27001 certification, independent penetration testing, or Marketplace badges not yet awarded. A provider's certifications do not automatically certify an app's code. The candidate version has passed automated checks of logic, types, and packaging; hosted functional testing and commercial review remain in progress. This page will be updated after launch.