Security
How Solid Calendar keeps your data safe, and how to tell us about a security problem. What data the app keeps is in the privacy policy.
Report a security problem
Write to solicale@gmail.com or open a request in our support portal. Tell us what you found and how to reproduce it. We reply within 2 working days, keep you updated until it is fixed, and follow Atlassian's security bug fix policy for Marketplace apps. Please don't test against other customers' sites or data.
How the app is built
- Runs on Atlassian Forge. The current version runs on Atlassian's own platform, with no servers of our own and no Forge Remote. App data stays in Forge SQL for your site.
- Tokens are encrypted. Google and Microsoft sign-in tokens are kept in Forge encrypted secrets and deleted when a user disconnects the account.
- Least access. The app asks Jira only to read and update work items, read users and use its own storage. Google access is limited to calendars, Microsoft access to calendars and the basic profile.
- Your Jira permissions apply. Every request checks the user, the licence and the calendar's permissions. Background updates run with the calendar owner's Jira permissions.
- OAuth with PKCE. Accounts are connected with OAuth 2.0 and PKCE, using a signed, single-use state tied to the Jira user. We never see a password.
- Stateless sign-in relay.
auth.solicale.comonly forwards your browser back to your own Jira site after sign-in. It stores nothing and never sees tokens. - HTTPS only. Every connection, to Jira, Google and Microsoft, is encrypted.
- Clean logs. Logs hold error codes and internal IDs only, no tokens, emails or issue content.
How we work
- Source code is in a private repository with two-factor sign-in. Every company account uses two-factor sign-in.
- Every release goes through a code and security review, automated tests and an end-to-end test run before it ships.
- Dependencies are checked for known vulnerabilities before each release.
- App secrets live in encrypted Forge settings, never in code.
- If a security incident affects your data, we tell you and Atlassian, as Atlassian's Marketplace rules require.
The Connect version
The older Connect version runs on our own server at Amazon Web Services, reachable over HTTPS only, and keeps its data in a database there. Atlassian ends support for Connect apps on 31 January 2027. Sites move to the Forge version before then, and we then delete their Connect data.
What we don't have yet
Solicale is a small company. We don't hold compliance certifications such as SOC 2 or ISO 27001, and we aren't in Atlassian's bug bounty program yet. If you need more detail for a security review, write to us.