Security

Security Policy

Effective date: June 29, 2026  ·  Published by Chris Castle, Inc

1. Architecture and platform security

EpicViz is built on Atlassian Forge, Atlassian's serverless app platform. All backend execution — reading Jira data, calling the AI model, returning diagram data — runs inside Atlassian's own cloud infrastructure. Chris Castle, Inc does not operate any servers, VMs, containers, or databases of its own.

This architecture means:

• There is no EpicViz server to compromise, patch, or misconfigure
• Network perimeter, compute isolation, and runtime security are managed by Atlassian
• Forge functions run in an isolated sandbox per invocation — no persistent process state
• All traffic between the Jira browser client and the Forge runtime uses HTTPS/TLS, managed by Atlassian

Atlassian's platform security controls — including SOC 2 Type II, ISO 27001, and PCI DSS compliance for the Forge infrastructure — apply to all EpicViz execution. Details are available in Atlassian's Trust Center.

2. Access controls and permissions

EpicViz requests a single Jira permission:

• read:jira-work — read access to Jira issues and project data

EpicViz does not request write, admin, user management, or any other Jira scope. Within the read scope, the app accesses only the issue you are viewing and its direct children (summary, issue type, labels, components, and optionally description on paid plans). It does not enumerate projects, search across workspaces, or access unrelated issues.

Authentication is handled entirely by Atlassian's OAuth 2.0 implementation. EpicViz never sees or handles user credentials, session tokens, or API keys. Access is scoped to the authenticated user's own Jira permissions — EpicViz cannot read issues the user cannot read directly.

3. Data handling and storage

EpicViz does not store any Jira data. Each diagram generation is a stateless invocation: issue data is read from Jira, passed to the AI model, and the diagram is returned to the browser. No issue content, diagram output, user identity, or usage data is written to any persistent store by EpicViz.

The AI model (Claude, accessed via Atlassian's Forge LLMs API) is hosted by Atlassian within their own infrastructure. EpicViz does not call Anthropic's API directly or route data through any third-party AI provider. Atlassian's data handling policies for the Forge LLMs API govern how prompts are processed.

This marketing website (epicviz.chriscastle.com) does not use analytics, session tracking, or third-party scripts of any kind.

4. Vulnerability management

Chris Castle, Inc manages EpicViz's security posture through the following practices:

• Dependency monitoring — third-party npm dependencies are reviewed for known vulnerabilities before each release using npm audit and GitHub Dependabot alerts
• Code review — all changes to the EpicViz codebase are reviewed before deployment; no unreviewed code reaches production
• Principle of least privilege — the app requests only the permissions it needs; adding new scopes is treated as a security-relevant change requiring deliberate justification
• Forge platform updates — the Forge runtime is managed by Atlassian; runtime patches and security updates are applied automatically by the platform
• Prompt injection defense — AI prompts are constructed from structured Jira fields (summary, labels, issue type), not from free-form user input, reducing the attack surface for prompt injection

5. Incident response

To report a security issue, email [email protected] with the subject line "EpicViz Security Report". We respond to all security reports according to the following SLAs:

For confirmed incidents affecting customer data or app availability, affected customers will be notified within 72 hours of confirmation, consistent with applicable data breach notification requirements.

6. Responsible disclosure

We welcome security research on EpicViz and ask that researchers follow responsible disclosure practices:

• Report findings to [email protected] before public disclosure
• Allow reasonable time (minimum 30 days from acknowledgment) for a fix before publishing
• Avoid testing techniques that could harm other users' data or degrade service availability
• Do not test against production Jira environments you do not own or have explicit permission to test

We will publicly acknowledge researchers who report valid vulnerabilities (with their permission) and will not pursue legal action against good-faith security research conducted within these guidelines.

7. Security controls summary

• No server infrastructure — EpicViz has no servers to patch, harden, or monitor
• No stored data — stateless invocations mean no persistent attack surface
• Minimal permissions — read:jira-work only; no write or admin access
• Atlassian-hosted AI — LLM calls stay within Atlassian's infrastructure
• TLS everywhere — all communications use HTTPS, managed by Atlassian Forge
• Sandboxed execution — each function invocation runs in an isolated Forge runtime
• No secrets in code — no API keys, credentials, or tokens stored in source code
• Dependency auditing — npm audit run on each release cycle

8. Atlassian Marketplace compliance

EpicViz participates in the Atlassian Marketplace Partner program and adheres to Atlassian's Marketplace Developer Agreement and security requirements. Atlassian's Marketplace security review covers data handling, permission scopes, and app behavior prior to listing.

Because EpicViz is built on Forge, it is eligible for — and pursuing — the Runs on Atlassian designation, which Atlassian awards to apps that process data exclusively within their infrastructure.

9. Contact

Security reports: [email protected]
Subject line: EpicViz Security Report
General inquiries: epicviz.chriscastle.com

Chris Castle, Inc
Published: June 29, 2026