Where your data goes

The short version for your security team: nothing leaves Atlassian, and here is how you can verify that yourself.

This is the question every security review asks, so here is the direct answer: your data stays inside your own Atlassian site. We do not run servers, we do not have a database, and we cannot read your data.

Why that is true, not just a promise

All our apps are built on Atlassian Forge. Forge apps run on Atlassian's infrastructure, store their data in your Atlassian site, and must declare every outside address they are allowed to contact. Atlassian enforces that list. An app cannot quietly send data somewhere it did not declare.

For our apps, the declared list is either empty or contains only Atlassian's own domains. You can check this yourself: the Marketplace listing shows the permissions, and each app's Permissions, data and limits page in these guides lists them with an explanation.

What about the AI features?

Four apps use AI: AI Portal Chat, AI Triage, Workflow Toolkit and parts of the others' analysis. They all use Forge LLM, which is Atlassian's own AI service with models Atlassian hosts.

You do not need to buy an API key from anybody.
We do not hold API keys to outside AI providers, so we could not send your data to one.
We do not use your data to train anything.
Each app's privacy policy lists exactly what text is included in a prompt.

What each app stores

Storing something is different from reading it. Most of what our apps read is used and thrown away; only configuration and results are kept. The details differ per app, so each one has its own privacy policy:

AI Portal Chat — keeps conversations, so anything a customer types in the chat is stored.
AI Triage — keeps its decisions, and the Atlassian API token if you use team routing.
Secret Scanner — never stores the secret it finds, only a masked preview and a one-way hash.
Workflow Toolkit — keeps rules and their outcomes, not copies of issues.
Admin Toolkit — keeps the results of the reports you run.
Custom Fields Toolkit — keeps only configuration; field values belong to Jira.
License Waste Manager — keeps user data including email addresses, because that is what a licence review needs, plus your organisation API key.
Markdown Toolkit — keeps macro content and in-flight export jobs.

Two apps hold a credential you provide

License Waste Manager needs an organisation API key to see licence data, and AI Triage needs an Atlassian API token if you want team-based routing. Both are stored inside your own site and masked in the interface, but they are still credentials: create them for this purpose, and rotate them on your normal schedule.

Deleting the data

Atlassian controls this, not us. It is worth understanding, because “uninstall and it is gone” is not quite what happens.

When	What happens
While the app is installed	You delete data through the app's own screens. That deletion is immediate.
The moment you uninstall	The app runs an uninstall handler that clears its storage. Independently, Atlassian detaches the installation's data: it becomes inaccessible to the app, to your users and to us straight away.
After uninstalling	Atlassian keeps the detached data for a limited period before destroying it, under Atlassian's own retention policy. Atlassian's Forge documentation describes it as soft deleted and retained for 28 days.
Within 21 days of uninstalling	If you reinstall and want your previous configuration back, a re-link request can restore it. Only Atlassian can perform it, only we can raise it, and only if you ask us to.

Atlassian's own reference is Data lifecycle for Forge-hosted storage. Atlassian's backups follow Atlassian's schedule and are outside any app's control.

If you need something gone on a specific date

Delete it inside the app before you uninstall. Once the app is uninstalled, nobody can reach into that storage on your behalf — not you, not us — and the clock is Atlassian's.

There is nothing to email us for. We cannot delete this data faster than Atlassian's process, and we have no access to it. If you want the deletion behaviour in writing for an audit, this page and the privacy policies are it, and Atlassian's documentation is the primary source.