---
title: "Compliance and Security FAQ"
canonical: "https://support.appfire.com/space/SUPPORT/3722543118/Compliance%20and%20Security%20FAQ"
format: markdown
---
# Compliance and Security FAQ

This article provides a summary of compliance, security, and operational capabilities for BigPicture Advanced for Jira Cloud, based on common requirements for public-sector and enterprise assessments.

### Summary

This article covers multiple compliance and security use cases, including BSI C5 compliance, information security certifications (ISO/SOC 2), penetration testing protocols, accessibility (WCAG), localization, data portability, and service level commitments (SLA/RPO/RTO).

---

### 1. Compliance and Certifications

#### BSI C5 Compliance

- **Status:** Partially Supported (via Infrastructure)
- **Details:** Appfire relies on AWS as the cloud service provider, which is C5 compliant. BigPicture is a Forge application, and Atlassian is also C5 compliant. Appfire maintains ISO 27001, ISO 27017, and SOC 2 Type II reports, which are key components of the C5 standard.
- **Documentation:**
  - [Atlassian C5 Assessment](https://www.atlassian.com/trust/compliance/resources)
  - [AWS C5 Information] (`https://aws.amazon.com/compliance/bsi-c5/`)
  - [Appfire Trust Center] (`https://trust.appfire.com/`)

#### Information Security Certifications (ISO & SOC 2)

- **Status:** Fully Supported
- **Details:** Appfire is ISO/IEC 27001 and ISO/IEC 27017 certified and maintains an annual SOC 2 Type II report.
- **Documentation:** Certificates and reports are available in the [Appfire Trust Center] (`https://trust.appfire.com/`).

---

### 2. Security Testing and Vulnerability Management

#### Penetration Testing

- **Status:** Fully Supported
- **Details:** Appfire performs annual security testing and testing after material changes using SAST & SCA, DAST, Vulnerability Management, Penetration Testing, Bug Bounty, and Atlassian's Ecoscanner. Appfire works with a third-party provider for Penetration Testing as a Service (PtaaS).
- **Documentation:** Attestation letters are available in the [Appfire Trust Center] (`https://trust.appfire.com/`). Specific findings are not shared.

#### Security Patches

- **Status:** Supported
- **Details:** Vulnerability remediation timeframes are defined in the Appfire Trust Center.
- **Documentation:**
  - [Vulnerability Resolution Timeframes] (`https://trust.appfire.com/`)
  - [BigPicture Release Notes](https://appfire.atlassian.net/wiki/spaces/BP/pages/16154636/Release+Notes)

---

### 3. Product Capabilities

#### Accessibility (WCAG 2.1 Level AA)

- **Status:** Supported
- **Details:** BigPicture provides an Accessibility Conformance Report (VPAT).
- **Documentation:** The VPAT report is accessible via the [Appfire Trust Center] (`https://trust.appfire.com/`).

#### German Localization

- **Status:** Not Supported
- **Details:** The BigPicture user interface is currently available in **English only**. This includes menus, messages, tooltips, and help content.

#### Data Export and Portability

- **Status:** Supported
- **Details:** Data import and export are handled via Atlassian tools.
- **Documentation:** See the "Data Erasure" section in the [Appfire Trust Center] (`https://trust.appfire.com/`).

---

### 4. Availability and Disaster Recovery

#### SLA, RPO, and RTO

- **Status:** Partially Supported
- **Contractual Guarantee:** Appfire does not contractually guarantee a specific uptime percentage under the standard End User License Agreement (EULA).
- **Metrics:**
  - **RPO (Recovery Point Objective):** 24 hours
  - **RTO (Recovery Time Objective):** 24 hours
- **Monitoring:** Live service availability and historical uptime can be monitored via the [Appfire Status Page] (`https://status.appfire.com/`).