Legal

Security Policy

How Certia is built, hosted, and secured — and how to report a security issue.

Status: Reflects the app's actual implementation as of September 2026

Unlike the Privacy Policy and DPA, this page describes what's built rather than what's promised, so it should stay accurate by construction — but re-check it against the codebase whenever the architecture changes, not just before launch. One claim below (dependency/vulnerability handling) is stated plainly as informal rather than dressed up, since that's the honest state of a pre-launch, solo-maintained app.

Hosting

Certia runs entirely on Atlassian's Forge platform. There are no separate servers, databases, or infrastructure that Four Leafs Technology operates or manages outside of it — deploying Certia means pushing code to Atlassian's own serverless runtime, not standing up hosting. All application data lives in Atlassian Forge Storage, scoped to each customer's own installation. Per Atlassian's Forge shared-responsibility model, Atlassian encrypts this storage at rest and protects network traffic with TLS, as an inherent part of operating the platform.

Access control

Every part of the application that returns another person's data checks, on the server, that the calling user actually holds the customer's Jira ADMINISTER global permission for every admin-facing route — checked per request, never inferred from which screen a request nominally came from. A reviewer can only read or act on their own assigned review items and notifications; there is no path in the application for a reviewer to see another reviewer's queue.

What leaves Atlassian's infrastructure

Nothing. Certia makes no outbound calls to anything outside Atlassian. AI-assisted pre-classification of review items into "likely safe" / "needs review" runs on Atlassian's Forge LLMs service, which hosts the AI model (Anthropic's Claude) inside Atlassian's own cloud. The classifier receives only four attributes: group names, role names, days since last active, and computed risk-flag labels — never a person's name, email address, or Atlassian account ID. AI classification is advisory only; every decision is made and recorded by a human reviewer.

Report integrity

Certified reports are rebuilt from an append-only audit log, and each one carries a SHA-256 integrity fingerprint computed from that log at generation time. Anyone holding a previously generated report can paste its fingerprint back into Certia to confirm the underlying audit log hasn't changed since — a tamper-evidence check an auditor can run themselves, not just a claim we make.

Vulnerability & dependency management

Stated plainly, not dressed up: as a pre-launch, solo-maintained application, Certia does not yet run automated dependency scanning (e.g. Dependabot) or a continuous-integration security pipeline, and does not currently offer a bug bounty program. Dependencies and `forge lint` output are reviewed manually before each release. This is an area we expect to formalize as Certia grows past its earliest customers — see the DPA's audit-rights section for what compliance documentation we can offer today.

Reporting a security issue

If you believe you've found a security issue in Certia, email [email protected] with details — we target a first response within 2 business days. This channel is also where a confirmed breach would be handled, consistent with the notification commitment in the Data Processing Agreement.

See the Privacy Policy for what data Certia collects and why, and the Data Processing Agreement for the contractual terms governing that processing.

Back to Certia