Data security and privacy
Last updated: 2 November 2026
This page describes how Advanced Export for Jira handles your data. It applies to the app as installed from the Atlassian Marketplace. Our privacy policy covers everything else, including who we are, your rights and how to contact us.
Summary
Section titled “Summary”| Exports you download in the browser | Built in your browser. Jira data is not sent to our servers. |
| Scheduled and agent-run exports | Generated on our servers, delivered, then deleted. Files are kept only for download links and the API, for as long as you choose (default 3 days). |
| What we keep | Your export and schedule configuration, delivery settings, and a log of each run. Not the content of your Jira work items. |
| Selling or sharing data | We never sell your data, and never use it to train AI models. |
| Deletion | Configurations can be deleted in the app at any time. Email us to delete everything for your site. |
Our role
Section titled “Our role”For Jira data that the app processes on your behalf, your organization is the data controller and we are a data processor: we process it only to provide the app, following your configuration. For the small amount of data we collect to run and improve the service (support requests, usage statistics and error reports, described below), we are the controller.
What data the app processes
Section titled “What data the app processes”Exports you run in the browser
Section titled “Exports you run in the browser”When you preview or download an export in Jira, the app reads the work items from Jira and builds the file in your browser. The work items and the file are not sent to our servers.
The app may keep your current editor choices (for example the selected fields) in your browser’s local storage.
Scheduled exports
Section titled “Scheduled exports”A scheduled export, or an export you run with Run now or Send now, is generated on our servers. To do that, our servers read the work items from Jira, with the permissions of the schedule’s owner (or the app’s own permissions, if a Jira admin allowed that), build the file, and deliver it.
What happens to the file depends on how it is delivered:
| Delivery | Is the file stored? |
|---|---|
| Email attachment | No. It is passed to the email provider and not kept by us. |
| SFTP upload | No. It is uploaded to your server and not kept by us. |
| Download link, API, webhook | Yes, as a temporary file, until the link expires. You choose how long (default 3 days). It is then deleted. |
The Jira data read during a run is held in memory or in a temporary file on the server only for the duration of the run.
What we store about your exports
Section titled “What we store about your exports”To run your schedules, we store:
- Export configurations: name, work item source (filter, JQL, board or sprint), selected fields, format options and, for SQL exports, the SQL query.
- Schedules: timing, delivery method and its settings, including recipients’ email addresses.
- A log of each run: when it ran, whether it succeeded, the number of work items, the size of the file, and any error message.
- App settings chosen by your Jira admin.
- Identifiers: your Jira site’s URL and ID, and the Atlassian account IDs of the people who own exports and schedules. We store account IDs, not names. Email addresses of recipients chosen by account are looked up in Jira at the time of sending.
- Credentials you give us: SFTP passwords and keys, and your own SendGrid API key. These are encrypted in the database.
We do not store the content of your Jira work items, apart from the temporary files described above.
AI tools (Rovo and MCP)
Section titled “AI tools (Rovo and MCP)”When you use Advanced Export through Rovo or another AI client, the agent calls the app’s tools on our servers, with your Jira permissions.
- Live previews are generated on request and not stored.
- Datasets, which the agent builds to answer questions with SQL, hold a copy of the selected work items and their history. A dataset can only be used by the person who built it. It is deleted after 4 hours by default and at most 24 hours, or sooner if you ask the agent. Datasets are only available to sites whose data is processed in the US region, and a Jira admin can turn them off in App settings.
- What you write to the agent, and its answers, are handled by Atlassian Rovo (or the AI client you use) under its own terms. We do not receive your conversation, only the tool calls.
See Data and deliveries for details.
Support requests
Section titled “Support requests”When you send a bug report, feature suggestion or question from the app’s Help menu, we receive your name and email address (read from Jira), your site, the page you were on, the app version and the error you were looking at. No work items and no export configuration are attached. Requests are stored in our own Jira Service Management site so that we can reply.
Usage statistics and error reports
Section titled “Usage statistics and error reports”To understand how the app is used and to fix problems, we collect:
- Usage events (Mixpanel): which pages and features are used, linked to your Atlassian account ID and your site, and a daily count per site of exports, schedules and runs. These never include anything you wrote: no names of exports, JQL or SQL.
- Error reports (Sentry): technical details of errors in the browser and on our servers, which can include your IP address and account ID. For a small sample of sessions, and for sessions in which an error occurs, Sentry records a replay of the app’s screen to help us reproduce the problem. Text and images in replays are masked before they leave your browser.
- Server logs: technical logs of requests and runs, kept for a limited time.
Where your data is stored
Section titled “Where your data is stored”A Jira admin chooses a data processing region, US or EU, in App settings.
| US region | EU region | |
|---|---|---|
| Scheduled exports are generated on | Servers in the US | Servers in the EU |
| Configurations, schedules and run logs are stored in | The US | The US |
| Temporary report files are stored in | The US | The US |
| AI tool calls and datasets are processed in | The US | The US (datasets are not available) |
The region setting controls where scheduled exports are generated. Our database and file storage are currently located in the US for both regions. If your organization requires all data to be stored in the EU, please contact us before scheduling exports.
Transfers of personal data from the UK and EU to the US rely on the UK and EU adequacy decisions for organizations certified under the EU-US Data Privacy Framework and the UK extension, or on Standard Contractual Clauses, as offered by the providers below.
Service providers (sub-processors)
Section titled “Service providers (sub-processors)”| Provider | Purpose | Location |
|---|---|---|
| Atlassian | Forge platform that hosts the app’s interface; Rovo; our support desk | Per your Atlassian data residency settings |
| Heroku (Salesforce) | Application servers and database | US; EU for scheduled exports in the EU region |
| Amazon Web Services | Temporary report files and datasets (S3) | US |
| Redis Cloud | Job queue for scheduled runs | US |
| Mailgun (Sinch) | Sending emails from our built-in email service | US |
| Mixpanel | Usage statistics | US |
| Sentry | Error reports | EU (Germany) |
| Papertrail and Sumo Logic | Server logs | US |
| QuotaGuard | Fixed outgoing IP address for connections to your servers | US |
Each provider is bound by a data processing agreement and holds its own security certifications (such as ISO 27001 and SOC 2).
Data is also sent to destinations you configure: email recipients, your SFTP servers, your webhooks, and your own SendGrid account if you choose it as the email provider. These are under your control.
Security
Section titled “Security”- All connections to and from our servers are encrypted (HTTPS, SFTP).
- Credentials you give us are encrypted in the database.
- Our servers access Jira with Atlassian-issued tokens, limited to the scopes the app declares, and as the user who owns the export, so an export never shows more than its owner can see in Jira.
- Access to production systems is restricted to the people who maintain the app.
This app follows the Atlassian App Security Guidelines, is part of the Marketplace Security Bug Bounty Program, and is Cloud Fortified.
To report a security issue, email support@advancedinsights.app.
How long we keep data
Section titled “How long we keep data”| Data | Kept for |
|---|---|
| Temporary report files | Until the download link expires: the period you choose, default 3 days |
| Datasets | 4 hours by default, at most 24 hours |
| Configurations, schedules, app settings | Until you delete them in the app, or ask us to delete them |
| Run logs | As long as the export they belong to |
| Support requests | As long as needed to handle the request and keep a record of it |
When you uninstall the app, scheduled exports stop and datasets are deleted. Configurations and schedules are kept, so that reinstalling the app restores them. To have all data for your site deleted, email us from an address associated with the site; we will confirm once it is done, within 30 days.
Your rights
Section titled “Your rights”Your rights over your personal data, and how to exercise them, are described in our privacy policy.
Changes to this page
Section titled “Changes to this page”We will update this page when the way the app handles data changes, and change the date at the top. For significant changes, we will also notify customers through the app or by email.