Security and data handling

Runs on Atlassian

WhatShipped is built on Atlassian Forge. It has no servers of its own and no external network access. It reads and writes only Jira, Confluence and Forge storage on your site, and is built to meet Runs on Atlassian.

The model

Drafts are written by Atlassian's Forge LLMs service, using Claude models (Haiku to read issues, Sonnet or Haiku to write the draft). Prompts and issue text are processed inside Atlassian's platform and are not sent outside Atlassian. We make no claim about model-side retention beyond what Atlassian publishes for Forge LLMs. We do not train models on your content.

What reaches the model

Sent: issue summaries, descriptions, comments, labels, resolution, fix version, sprint and parent summary, plus linked item titles if you turn that on.

Removed or replaced first:

Assignee and reporter fields are never sent.
@-mentions become "[person]".
Email addresses, phone numbers, key=value credentials and known API token prefixes become placeholders.
Known display names are scrubbed from the text.

After drafting, a checker rejects any bullet containing a name from the input set.

Permissions (scopes)

Scope	Why
`read:jira-work`	Read issues and versions to draft notes
`read:sprint:jira-software`, `read:board-scope:jira-software`	List boards and sprints for sprint digests
`write:jira-work`	On publish, store a page link as a project property, and add a link to empty version descriptions if you turn that on
`read:jira-user`	Count user accounts to size the paid budget. Only the number is kept. No user record is stored or sent to the model
`read:space:confluence`, `read:page:confluence`	Find the space and parent page
`write:page:confluence`	Create or update the note page, as the person publishing
`storage:app`	Store notes, settings and the cost ledger

Who acts

Publishing and anything you start from the screen runs as you, with your permissions.
Scheduled digests and auto-drafts on release read Jira as the app. They only ever produce drafts.
Each request is checked against the project you are in. Admin settings need a Jira admin.

What is stored, and for how long

Everything is in Forge storage for your site.

Data	Kept
Note drafts and your edits, with the issue quotes behind each bullet	13 months by default, then: unpublished drafts deleted; published notes keep only the published text
Names used for the leak check	Only while a draft is being made. Deleted on completion or failure. Leftovers swept after 7 days
Edit memory pairs	Newest 50 per project and voice
Cost ledger	13 months
Error log (type, stage, note id, short technical message)	90 days

Admins can set the note retention from 1 to 60 months on the admin page.

We do not store Atlassian account IDs, user names, email addresses, passwords or API tokens.

Logs

App logs record error types, ids, status codes and sizes, never response bodies or issue text.

Deletion

Delete note on the review screen removes the note, draft, job, publish record and temporary data at once. Published Confluence pages stay; they are your content.
Uninstall: Atlassian deletes the app's Forge storage for your site.

Security reviews

We keep a self-assessment against Atlassian's security requirements for cloud apps. For questionnaires, a data processing addendum or to report a vulnerability, email hello@whatshipped.co.uk. A person answers these.