Security Policy & Incident Response Plan

1. Zero-Infrastructure Architecture (Atlassian Forge)

SyncGrid Solutions builds exclusively on the Atlassian Forge serverless platform. We do not operate, host, or maintain any external vendor application servers, virtual machines, or third-party customer databases:

• Compute & Isolation: All backend resolvers execute inside Atlassian's isolated Forge Node.js runtime with per-tenant context isolation enforced by Atlassian Cloud.
• Credential Vaulting: Third-party OAuth 2.0 tokens (such as read-only Asana tokens) are stored, encrypted at rest, and refreshed exclusively by Atlassian Forge's native External Authentication vault. SyncGrid Solutions personnel cannot view or export user tokens.
• Minimal Data Footprint: Only non-personal macro configuration identifiers (such as workspace/project IDs mapped to Confluence macro localId) are persisted in Atlassian's encrypted Forge Key-Value Store (@forge/kvs). No Confluence page bodies or Asana task payloads are stored at rest.

2. Secure Development & Dependency Scanning

• Least-Privilege Scopes: Every app requests the minimum read-only Atlassian and third-party scopes required for rendering UI Kit components.
• Automated Vulnerability Checks: Prior to every production Forge deployment, dependencies and lockfiles are audited against npm audit, Google's Open Source Vulnerabilities (OSV) database, and @forge/lint.
• Account Security: All administrative developer, Marketplace Partner, and domain registrar accounts enforce mandatory Two-Step Verification (2SV / MFA).

3. Vulnerability Disclosure Policy

Security researchers, customers, and Atlassian security teams may report suspected vulnerabilities directly to [email protected] with [SECURITY] in the subject line. Please include reproduction steps and affected app version without including live customer credentials.

4. Written Incident Response Plan (IRP)

In the event of a confirmed or suspected security incident or critical vulnerability affecting any SyncGrid Solutions Marketplace app, we execute a 5-stage response protocol:

1. Triage & Verification (Target: ≤ 4 Hours): Acknowledge receipt, verify scope and severity (Critical / High / Medium / Low), and determine whether customer data or third-party API tokens could be affected.
2. Containment: Immediately deploy a hotfix or roll back the affected Forge production deployment via forge deploy -e production, or coordinate with Atlassian Ecosystem Security if platform-level revocation is warranted.
3. Notification (Target: ≤ 24–72 Hours): Notify Atlassian Marketplace Security via the Ecosystem Security portal and notify impacted customers in accordance with GDPR and Atlassian Marketplace Partner requirements.
4. Eradication & Patch Verification: Patch root causes, add regression tests and static checks, verify zero vulnerability findings via OSV/npm audit, and publish patched release notes.
5. Post-Incident Review: Document root cause, timeline, and preventive engineering controls within 5 business days of resolution.

Last updated: November 2026