Data security and privacy statement

Bauer Information Technology has selected Heroku to host the application and Firebase to store all data for the add-ons. Heroku and Firebase were selected to due to the high levels of support, quality of service, reliability and security standards they offer their customers.

Our platform at Heroku was designed and optimized to run all add-ons and has multiple levels of redundancy built in. The applications themselves run on separate front-end servers than those on which the data is stored.

The safety and security of your data is our top priority. Firebase requires SSL encryption with 2048-bit certificates for all data transfer and allows restricted reading and writing via granular access controls and custom authentication.

Only customer data required for the operation of the add-ons will be accessed from JIRA OnDemand and stored within the add-on’s databases . This data will be encrypted during transit between data centers and when it is removed from data centers for backup purposes. All data is replicated and backed up to multiple secure locations.

Access to the Firebase data storage is limited to authorized personnel only, as verified by Firebase identity verification measures. Physical security measures include: on-premises security guards, closed circuit video monitoring, man traps, and additional intrusion protection measures.

Our primary data center is located within the US and our secondary data center as well.

Excepting the Database Administrator, no Bauer Information Technology members of staff maintain an account that can access your private data. This access is required for application health monitoring, or for performing system and application maintenance. Authentication to application servers is done via individual passphrase-protected public keys, rather than passwords, and the servers only accept incoming SSH connections from Heroku. All our add-ons are designed to allow application data to be accessible only with appropriate credentials, such that one customer cannot access another customer’s data without explicit knowledge of that other customers’ login information. Customers are responsible for maintaining the security of their own login information.