Last updated: October 15, 2026 — the app no longer asks any AI service anything, and declares no address outside Atlassian
This page describes how Project Commander protects your data. Project Commander is a planning and analysis app for Jira Cloud, built and hosted entirely on the Atlassian Forge platform.
Project Commander runs as a Forge app inside Atlassian's own cloud infrastructure. It has no separate servers of its own. This means:
All data the app stores is held in Atlassian Forge storage. It is isolated to your Jira instance and scoped to your Atlassian account.
The app requests only the Jira permissions it needs to do its job — reading sprints, issues, boards, projects, and user display names, and writing sprint and issue changes you make through the app. Access to your data inside the app is governed by your existing Jira permissions: users only see what their Jira account already allows them to see.
Project Commander sends no data outside Atlassian. It asks no AI model anything: every figure, and every sentence the Ask panel writes, is worked out by the app’s own code inside Forge.
Feature-use counts. The app counts how often some of its features are used — for example, the app being opened, a tab being opened, an issue being moved or edited, a sprint being created or completed — through Atlassian’s own usage metrics for Forge apps. Each count is a bare tally that goes up by one: no user, site, project or issue is attached to it, and it stays inside Atlassian. To count how many different people use the app, the app keeps a note in its own storage on your site, against each person’s Atlassian account ID, of when they first opened it; that note never leaves your site and is deleted with the rest of the app’s data on uninstall. There is no third-party analytics or tracking service. Full details are in our Privacy Policy.
The app declares no address outside Atlassian that it is permitted to reach, so the data egress list Jira shows while the app is being installed, and in Atlassian Administration under Connected apps, names none. Earlier versions declared three AI providers’ addresses there — api.anthropic.com, api.openai.com and generativelanguage.googleapis.com — and those are gone.
Project Commander implements Atlassian's personal-data reporting process. On a regular schedule it reports to Atlassian which Atlassian accounts it holds data for. When Atlassian notifies the app that an account has been closed, the app automatically erases that person's stored data; when an account's details change, the app refreshes them so it does not keep stale copies.
App data persists until you remove it through the app or uninstall the app. Uninstalling Project Commander deletes everything it stored in Forge storage — configuration, team capacity, velocity history, snapshots, risks, action items, retrospectives, governance and portfolio data, plan baselines, alert dismissals, and anything an earlier version stored for its AI features, including an AI provider key.
This website applies standard hardening, including a Content Security Policy, clickjacking protection, MIME-type sniffing protection, and a strict referrer policy. The website does not collect personal data. It counts page views and web app use with its own counter, run on the same host as the website: it keeps totals per day and an anonymous daily visitor code, made by scrambling the visitor’s network address and browser with a secret and the date so it cannot be turned back into either. It sets no cookies and stores no names, email addresses or network addresses. The installed Jira app never calls it.
The web app at projectcommander.app/app is separate from the installed Jira app, and everything else on this page describes the installed app — the web app shares none of its data paths. The web app offers two modes, and to be equally clear about each:
Where we are today:
Where we inherit Atlassian's certifications: Because Project Commander runs on Forge, the underlying infrastructure is covered by Atlassian's own certifications:
For enterprise buyers: many accept "runs on Forge, inherits Atlassian's certifications" as sufficient for the data-handling layer, given we don't store data outside your tenant. If SOC 2 completion is a gating requirement for your organization, email us and we'll share our current audit timeline in writing.
The complete list of third parties Project Commander uses:
| Sub-processor | Purpose | Data shared |
|---|---|---|
| Atlassian | Hosting (Forge), authentication, storage | All app data (lives inside your tenant, owned by you) |
That is the complete list. There is no third-party analytics tracker (the app’s only usage counts are the anonymous tallies kept by Atlassian, described in section 5), no CDN caching your data, no email service reading your data, no logging service outside Atlassian's own. No AI provider is called.
Project Commander runs on Atlassian's Forge platform, so its availability equals Atlassian's availability. Atlassian's public status page: status.atlassian.com.
Since launch there has been no downtime traceable to Project Commander's own code. If a service-affecting incident occurs, it will appear on Atlassian's status page under Forge. We do not schedule maintenance windows on our side; Atlassian owns platform upgrades.
If a security incident affects Project Commander or its handling of your data:
Where does our data go?
Nowhere outside your Jira Cloud tenant and your own browser (which keeps a copy of the issues you have read, for speed, for your account only). No AI provider is ever sent anything.
Can you access our data without permission?
No. Forge storage is isolated per tenant. We cannot read your data from outside your Jira instance.
Does the web app at projectcommander.app/app touch our Jira?
Its demo mode cannot — it runs on generated sample data in the visitor's browser and makes no Jira calls. Its optional connect mode uses Atlassian's official sign-in (OAuth): the user approves read-only access on Atlassian's own consent screen for one chosen site, and can revoke it at any time from their Atlassian account's Connected apps page; the access grant passes through our relay per request and is never stored or logged. See section 8.
What happens if you're breached?
A breach would have to happen inside Atlassian's Forge platform, since that's where all data lives. We'd notify affected customers within 72 hours per GDPR. In practice, an incident affecting your data would be an Atlassian incident.
Do you have SOC 2?
Not our own certification yet — in progress. We run on Atlassian's SOC 2 Type II Forge platform, which many enterprises accept as sufficient.
Do you have a DPA?
Yes — see our Data Processing Agreement. Standard EU-approved terms, GDPR-compliant, sub-processor list matches this page.
Can you complete a security questionnaire?
Yes. SIG Lite, CAIQ, and custom questionnaires completed personally, typical turnaround 5 business days. Email support with the questionnaire attached.
Can we do a penetration test?
Project Commander is a Forge app running in Atlassian's infrastructure. Any pen test would need to conform to Atlassian's rules of engagement. Email us and we'll work with you and Atlassian to structure it.
We take security reports seriously and will respond promptly. If you believe you have found a vulnerability or have a security concern about Project Commander, please contact us using the details below. Please include enough detail to reproduce the issue, and give us a reasonable opportunity to address it before any public disclosure.
Response commitment for verified vulnerability reports: acknowledgment within 24 hours, validity confirmation within 72 hours, fix ETA within 7 days. We credit reporters in the changelog with their permission.
To report a security issue or ask a security question, email us:
Email: support@projectcommander.app