Security

Tintboard is built so that there is as little as possible to protect: no Tintboard server holds or receives customer data.

How Tintboard handles your data

• Runs on Atlassian. Both apps run on Atlassian Forge, keep their settings in Forge storage and in your own Jira and Confluence, and send nothing outside your site.
• The extension talks only to your site. It works on atlassian.net pages only, uses each person's existing session, and never reads or stores passwords or API tokens.
• Signed rules. The rules the extension reads are signed by the app, and checked against the site name and their date, so someone who can edit a project's settings can't fake them.
• Minimal permissions. The extension asks for storage and access to atlassian.net only, and loads no remote code. The apps request read access to issues and spaces, plus write access to the one property each uses to publish their settings.
• Safe by default. If Jira or Confluence changes a page, Tintboard switches the affected styling off rather than breaking the page. Anyone can turn it off with safe mode.

Full answers are in our Marketplace Privacy & Security tab, and the privacy policy lists every piece of data the apps keep.

Report a vulnerability

Email hello@tintboard.com with the steps to reproduce. Please don't test against sites you don't own.

• We acknowledge reports within 2 business days.
• We fix confirmed issues in supported versions as fast as their severity requires, and tell you when the fix ships.
• We credit reporters who want it, once the fix is out.

Supported versions

The current version of the Jira and Confluence apps (updated automatically by Atlassian), and the current and previous version of the browser extension.