Security & Trust

Know what RevFlow stores and where data flows.

RevFlow handles quote, delivery, and revenue-control data in Jira Cloud. This page documents the current Forge architecture, scopes, configurable permissions, optional email providers, and support routes.

App hosting

RevFlow is built as an Atlassian Forge app for Jira Cloud. The app exposes a Jira project page named RevFlow and a Jira issue panel named RevFlow.

App storage

Quote records, clients, products, revenue streams, recurring templates, history, exchange rates, report email settings, and configuration are stored using Atlassian Forge app storage APIs.

Configurable access

RevFlow supports permission modes for Anyone, Named users, Project admins, and Jira admins across setup, quote actions, deletion, sending, and report viewing.

Requested Jira scopes

  • storage:app for Forge app data storage.
  • read:jira-work to read Jira project, issue, status, sprint, estimate, and work context.
  • write:jira-work to support Jira work interactions used by the app.
  • read:jira-user to read Jira user details where needed, such as prepared-by, sender, subscriber, and permission workflows.

Optional email providers

Quote email sending is optional. The current provider choices are None, Mailgun, and SendGrid. PDF generation does not require email sending to be configured.

Data processed by RevFlow

RevFlow may process client names, recipient names and emails, quote titles, quote values, products, rates, quantities, tax settings, currencies, PO numbers, systems, revenue streams, notes, forecasted completion dates, linked Jira issue keys, generated PDF content, quote status, version history, recurring templates, report settings, billing export settings, and setup configuration.

RevFlow may read Jira project and issue keys, summaries, issue types, statuses, sprint metadata, parent or epic relationships, estimates, logged time, and Jira user account identifiers or display names needed for the workflow.

Data outside Atlassian

The core quote and configuration workflow is stored through Forge app storage. When email sending is configured and a user sends a quote email, recipient details, email content, and the generated quote PDF are sent to the configured Mailgun or SendGrid endpoint for delivery.

The production app egress allow-list is restricted to Mailgun US, Mailgun EU, and SendGrid for backend email delivery. Generic custom HTTP email endpoints are not enabled in the productised provider list.

Website cookies

The public website does not currently set analytics cookies, advertising cookies, account registration cookies, or contact-form cookies.

Data retention and deletion

RevFlow data remains in Forge app storage until users delete it, the app is uninstalled, or a retention or deletion process is requested and completed. Contact Quotaurus for access, correction, deletion, or uninstall data questions. Include the Atlassian site URL and enough detail to locate the relevant records.

Subprocessors

Atlassian provides Jira Cloud and Forge. Mailgun or SendGrid are involved only when quote email sending is configured and used. Support emails sent to Quotaurus are processed by the provider used for the relevant mailbox. The app may load Atlassian JSM helpdesk widget assets for support inside the project page.

Backups and incident response

Backup, disaster recovery, and incident response details should be confirmed during procurement or Marketplace security review. Security reports can be sent to support@quotaurus.com.

Security contact

For vulnerability reports, email support@quotaurus.com with a clear subject line. Avoid public disclosure until the issue has been reviewed.