---
title: "Data policy (v1)"
canonical: "https://support.appfire.com/space/CR/139264185/Data%20policy%20(v1)"
format: markdown
---
> Macro (aura-html)

We take data security very seriously, so we use only trusted service providers with the highest security standards. On this page, you will find details on what data we store, where we store it, and how we secure it. If you think something is missing or you have any security-related questions, please let us know at [Appfire Support Portal](https://apps.appf.re/crt/support) or [support@appfire.com](mailto:support@appfire.com).

## Service providers

- [Heroku](https://appfire.atlassian.net/wiki/spaces/CR/pages/139264185/Data+policy+v1#heroku)
- [Heroku Postgres](https://appfire.atlassian.net/wiki/spaces/CR/pages/139264185/Data+policy+v1#Heroku-Postgres)
- [MongoDB Atlas](https://appfire.atlassian.net/wiki/spaces/CR/pages/139264185/Data+policy+v1#MongoDB-Atlas)
- [Papertrail](https://appfire.atlassian.net/wiki/spaces/CR/pages/139264185/Data+policy+v1#Papertrail)
- [Bugsnag](https://appfire.atlassian.net/wiki/spaces/CR/pages/139264185/Data+policy+v1#Bugsnag)
- [Google Analytics & Google BigQuery](https://appfire.atlassian.net/wiki/spaces/CR/pages/139264185/Data+policy+v1#Google-Analytics)

[SUB-PROCESSOR] – The providers with this label are our data sub-processors as defined by European General Data Protection Regulation (GDPR).

## Heroku

[SUB-PROCESSOR] Canned Responses application runs on Heroku environment. Besides the application itself, Heroku stores application access logs that contain the user IP, user key, instance URL, and user JWT token. These logs are purged after 30 days.

## Heroku Postgres

[Heroku Postgres](https://www.heroku.com/postgres) stores data provided during the [installation handshake](https://developer.atlassian.com/cloud/jira/platform/authentication-for-apps/). Stored keys authenticate us to clients' instances.

The database is secured using a security mechanism provided by Heroku. See [https://www.heroku.com/policy/security#postgres](https://www.heroku.com/policy/security#postgres) for details.

### Stored Data

- A key that identifies Jira instance
- Shared secrets for communication with Jira

## MongoDB Atlas

[SUB-PROCESSOR] We use [MongoDB Atlas](https://www.mongodb.com/cloud/atlas) to store the templates. Each Jira instance uses a separate collection. Only users from a particular Jira instance can access the templates from that instance.

The database is backed up every week, and the last eight backups are stored.

### Stored data

- template name and content
- template creator's user key
- templates scopes including project ids and user keys
- template creation and update time
- client's license SEN

We store the minimal amount of data needed to provide our service.

We don't store work item summaries, descriptions, comments, or other sensitive information. We don't store full usernames or emails, but we use user keys and project keys provided by Jira instead.

## Papertrail

[SUB-PROCESSOR] We use Heroku addon [Papertrail](https://elements.heroku.com/addons/papertrail) to store application logs. Logs are in the system for 30 days. Log archives are stored from the last 365 days. Papertrail allows us to detect suspicious patterns in the logs and notify us whenever they are detected, which improves our reaction time. It also allows us to analyze the application's behavior after an incident occurs. 

### Stored data

- Access log – web addresses accessed by the user browser **when communicating with Canned Responses add-on**. It includes the following data:
  - request date
  - IP address
  - work item id
  - timezone
  - location
  - user key
  - URL that the application was run on (includes Jira URL, JQL query, project key, and work item key)
  - user authorization token
  - browser name and version
- Application logs – internal application messages that don't contain any personal data.

We analyze application logs only to monitor application health and to do post-incident analysis

If you would like us to skip processing logs from your instance, please let us know at [support@appfire.com](mailto:support@appfire.com)

## Bugsnag

[SUB-PROCESSOR] Bugsnag is a tool for the reporting of in-browser errors. It allows us to fix errors before people report them to us.

### Stored data

- Jira client key
- board id
- User IP address
- User language
- User browser information (browser, version, locale, operating system, user agent)

## Google Analytics & Google BigQuery

For a better understanding of our clients, we collect anonymous statistics on add-on usage. These statistics tell us how we should develop our plugin to make our customers happy. 

### What is collected

The following table is intended to give you a complete understanding of the policy that we use to collect analytics data.

This table is **not** intended to list all the possible events collected by the add-on. It is intended, however, to list all rules and exceptions from those rules so that you are able to assess whether something may be collected or not. 

| **Data type** | **Comments** |
| --- | --- |
| User interface and usage | Displaying and interacting with all components and pages **added by Canned Responses **including:<br>- Canned Responses comment box
- manage templates dialog
- add/edit template dialog
- settings pages<br>Interacting means clicking on the components or changing their state. |
| Flags and statistics | We collect boolean flags and statistical numbers from the entered data. This applies to data gathered via add-on components or pages (including configuration and usage pages). For example:<br>- Comment box was expanded
- Template was inserted
- Comment was posted
- Template filters are used
- Add-on page or panel was opened<br>Flags and statistics **do not** contain any user-created data. |
| Context | We collect a few general context values from Jira.<br>- license type (evaluation/paid)
- type of the work item being commented (Jira Service Management work item or not)
- is Chrome extension used or not<br>Context parameters **do not** contain any user-created data. |

### What is not collected

In Google Analytics, we do **not** collect any data but the minimal and anonymous data based on the rules described above. In particular, we do **not** collect any information about users, work items, values of comments, or any identifiable information about the Jira instance itself.