How Radrly apps handle your data
Facts only, with a link to the source for each one. Every app has its own security, privacy and legal pages; this page brings them together.
Built on Atlassian Forge, zero egress
All six Radrly apps for Jira (MarginRadar, AccessRadar, ConfigRadar, LimitRadar, CapRadar and LeakRadar) follow the same architecture.
No Radrly servers
Built entirely on Atlassian Forge. No Forge Remote, no Connect, no backend operated by Radrly and no public REST API. The apps declare no remotes and no external permissions, which is what the Runs on Atlassian programme requires; the badge itself is awarded by Atlassian.
Data stays in Atlassian
App data is stored in Forge SQL and the Forge Key-Value Store on Atlassian infrastructure, with your Jira site's data residency. No connection to external servers, third-party APIs or outside AI services.
Minimum scopes
Each app requests only the Forge scopes it needs, and each app's security page lists every scope with the reason. AccessRadar uses only read scopes and never modifies Jira.
AI inside Atlassian
The Rovo agent in each Advanced edition answers from the app's own data inside Atlassian. LeakRadar's AI triage uses Forge LLMs and sees detected values only as placeholders.
Personal data
LeakRadar never stores a full secret or personal data value: only a masked snippet, a per-install fingerprint and the location.
Evidence you can verify
AccessRadar, ConfigRadar, CapRadar and LeakRadar offer signed or hash-chained records in their Advanced editions, so auditors can check that history was not changed.
E-commerce apps: documented data handling
The e-commerce apps run on infrastructure operated for each app. Here is what each app documents, with links to the full text.
CostRadar
The CostRadar privacy policy and Trust Center describe the data CostRadar processes, its sub-processors, international transfers and retention. CostRadar states that it does not sell personal data.
SafeRadar
Per the SafeRadar privacy policy, the database and backend are hosted in the EU (Frankfurt, Germany), OpenAI is used only for the AI Summary and AI Support Chat features, and withdrawal request records are kept for 5 years for EU audit obligations.
AgenticRadar
Per the AgenticRadar privacy policy and DPA, customer data is stored in the EU, in Contabo's data centre in Lauterbourg, France, and the sub-processors are Contabo for hosting and OpenAI for AI features. Agent Interaction Log records are deleted after 90 days, and all store data is deleted when Shopify sends the shop redaction request.
Vulnerability disclosure
Please email support@radrly.com with the subject "[App name] security", a description, steps to reproduce and the impact you see. Critical vulnerability fixes for Jira apps follow the timelines in the Atlassian Marketplace security bug fix policy. Machine-readable contact: /.well-known/security.txt.
Support hours: Monday to Friday, 09:00 to 17:00 CET/CEST, first response within one business day. Live app status: radrly.com/status.
Privacy requests: privacy@radrly.com.
Do Radrly Jira apps send data outside Atlassian?
No. Radrly apps for Jira are built entirely on Atlassian Forge with no remotes and no external permissions, and make no calls to servers outside Atlassian.
Where is the data of Radrly Jira apps stored?
In Forge hosted storage (Forge SQL and Key-Value Store) on Atlassian infrastructure, with your Jira site's data residency.
How do I report a security issue?
Email support@radrly.com with the subject "[App name] security", a description, steps to reproduce and the impact you see.