Security · Forge architecture
Where yourJira data goes,app by app.
Every Werare app is built on Atlassian Forge, so its compute and app storage run on Atlassian’s infrastructure, inside your tenant. Built on Forge doesn’t automatically mean no data leaves, though: 7 of our 20 apps make zero external calls, and 13 reach a third party for a specific feature. This page says which is which.
Werare is not SOC 2 or ISO 27001 certified and does not claim to inherit Atlassian’s certifications.
7
Runs on Atlassian
No external calls. Your data never leaves Atlassian.
13
Call an outside host
11 named in the table below, 2 declared at install.
§01 · In short
No blanket claims. Three facts.
7 apps make no external calls.
We ran forge eligibility against each app's deployed production version. For these 7, your data never leaves Atlassian, which is why they carry the Runs on Atlassian badge.
The other 13 say where they call.
Each reaches a third party for a specific feature: avatar CDNs, a working-days API, email delivery. The table names every host. For the 2 apps whose deployed version declares a host we haven't itemised, it points to the Marketplace permission screen instead of guessing.
Storage follows your residency.
Forge storage inherits the data residency your Jira site is already pinned to. You chose the region once. External calls, where an app makes them, may route outside it.
§02 · Per-app table
20 apps. One row each.
Runs on Atlassian means forge eligibility confirmed the app sends nothing outside Atlassian. External calls means it runs on Forge but reaches the hosts listed. Scope lists come straight from each app’s Forge manifest; open a row to read them, with the reason for each.
Showing 20 of 20 apps.
| No. | App | Status | Scopes | External egress | Residency |
|---|---|---|---|---|---|
| 01 | Advanced JQL KeywordsProduction v2.14.0 | Runs on Atlassian | None. Atlassian only. | Your site's region | |
OAuth scopes · From the Forge manifest
| |||||
| 02 | Advanced JQL FunctionsProduction v7.0.0 | Runs on Atlassian | None. Atlassian only. | Your site's region | |
OAuth scopes · From the Forge manifest
| |||||
| 03 | Data Generator for Jira CloudProduction v6.14.0 | Runs on Atlassian | None. Atlassian only. | Your site's region | |
OAuth scopes · From the Forge manifest
| |||||
| 04 | Custom Dashboard Charts and GadgetsProduction v10.2.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 05 | Organizational ChartProduction v8.12.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 06 | Advanced User ManagerProduction v6.0.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 07 | Custom Fields ToolboxProduction v14.4.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 08 | Advanced Kanban BoardProduction v7.3.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 09 | Attachment ManagerProduction v2.0.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 10 | Advanced Issue PickerProduction v2.0.0 | External calls | Declared at install; the hosts show on the Marketplace permission screen. | Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 11 | Field BehavioursProduction v2.29.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 12 | Project CharterProduction v4.1.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 13 | Spreadsheet for JiraProduction v3.14.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 14 | Private ToDo for Jira CloudProduction v2.0.0 | Runs on Atlassian | None. Atlassian only. | Your site's region | |
OAuth scopes · From the Forge manifest
| |||||
| 15 | External Data SyncProduction v5.7.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 16 | Label ProProduction v3.12.0 | Runs on Atlassian | None. Atlassian only. | Your site's region | |
OAuth scopes · From the Forge manifest
| |||||
| 17 | Group ManagerProduction v4.2.0 | External calls | Declared at install; the hosts show on the Marketplace permission screen. | Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
| 18 | Advanced Workflow ExtensionProduction v2.6.0 | Runs on Atlassian | None. Atlassian only. | Your site's region | |
OAuth scopes · From the Forge manifest
| |||||
| 19 | Diagram Drawing HubProduction v1.1.0 | Runs on Atlassian | None. Atlassian only. | Your site's region | |
OAuth scopes · From the Forge manifest
| |||||
| 20 | Advanced Timesheets & Worklogs for JiraProduction v2.1.0 | External calls |
| Storage in your region. Calls may leave it. | |
OAuth scopes · From the Forge manifest
| |||||
Status, scopes and hosts as deployed, checked July 2026 with Forge CLI 13.2.0. On uninstall, Atlassian’s platform removes the app’s Forge storage.
§03 · Fix windows
Fixed inside Atlassian’s deadlines.
Werare operates under Atlassian’s Security Bug Fix Policy for Marketplace apps. A reported vulnerability is fixed within these windows, by severity: a public commitment you can hold us to.
Bars drawn to scale, in days. Read Atlassian’s policy ↗
§04 · Badges
Atlassian’s badges, not ours.
Each is Atlassian’s to award, not ours to claim. Here is what each one means, and how many of our apps hold it.
Cloud Fortified
2 of 20
Atlassian's highest bar: independent security review, a published uptime SLO, and a 24-hour critical-issue response commitment, re-audited annually. Cloud Fortified apps may still call external services.
Custom Fields Toolbox and Custom Dashboard Charts and Gadgets.
Runs on Atlassian
7 of 20
Atlassian verifies programmatically, with forge eligibility, that the app uses only Atlassian-hosted compute and storage and sends no data out.
Advanced JQL Keywords, Advanced JQL Functions, Data Generator for Jira Cloud, Private ToDo for Jira Cloud, Label Pro, Advanced Workflow Extension, and Diagram Drawing Hub.
Marketplace Partner
All 20
Vendor 1219467. Every app is listed, reviewed and billed by Atlassian.
Vendor listing ↗§05 · Documents
The paperwork, in one place.
Found a vulnerability?Tell the engineers.
Report it, request the DPA, or ask what the table didn’t answer. Responsible disclosure is welcome; please leave live production data out of a report.