Security Statement

Overview

Togetha Software provides hosted Forge Apps for Atlassian Cloud Products. These Cloud Apps can be identified by the "Cloud" category in the corresponding Atlassian Marketplace listing. Our Cloud Apps do not store Customer Data locally, but store Customer Data in the corresponding Atlassian Cloud Product. The Atlassian Cloud Product Security Statement can be found here.

Facilities

Togetha Software Forge apps are hosted by Atlassian on Atlassian Infrastructure, and Atlassian manage the security of that Infrastructure. Our applications do not currently store any user data separately from the Atlassian application, or on other infrastructure.

Forge is a platform that lets us build apps and integrations on top of Jira, Confluence, and Compass Cloud products. When we build a Forge app, Atlassian takes care of the infrastructure, including security considerations.

We also utilise Atlassians Cloud for SaaS applications like Jira, Confluence, Compass and Bit Bucket which we use to build and support our Apps.

Certification

You can find Atlassian's Security Practices here.

Togetha Group is working to be certified as a Cloud Security Compliant vendor with Atlassian, with significant security program resourcing. You can learn more about Atlassian’s Marketplace Apps Trust programs.

People and Access

Within Togetha a limited number of trusted and vetted team members have access to the production environment for the purposes of maintaining our cloud applications and assisting our customers. Additionally, we monitor all access to Togetha Group’s Cloud.

Customers are responsible for maintaining the security of their own login information.

Data Storage

Our Cloud Apps do not store Customer Data outside their corresponding Atlassian Cloud Product.

Togetha may store information about you as a client, please refer to our Privacy Policy for details.

Data Retention

Togetha Software builds solutions with Forge that use Atlassian’s Functions-As-A-Service (FaaS) model so that client data remains in client instances and does not need to be handled outside their cloud tenancy or system boundary. Client data that is handled by us for the purposes of delivering our services is described in our DPA schedule. Backup data can be stored for up to 3 years on AWS.

Backups

For our Cloud Apps we recommend our clients familiarise themselves with Atlassian's Shared Responsibilities model for resilience, and work with them to find best pattern approaches to backing up and managing their instance data, within their own environments.

Togetha keeps multiple cloud backups of customer data related to sales and support for up to 3 years.

Security Incident Policy

Every care is taken by Togetha Group to protect customer data from incidents (either accidentally or deliberately) to avoid a data protection breach that could compromise security. For more information, please contact us for our Security Incident Policy via support@togetha.software.

Bug Fix Policy

Bug Severity - Critical

SLA - Within 10 business days of being reported

Example - Direct access to application or database servers

Bug Severity - High

SLA - Within 3 weeks of being reported

Example - Leakage of sensitive data through bugs / exploits in the application

Bug Severity - Medium

SLA - Within 6 weeks of being reported

Example - Leakage of non-sensitive data

Privacy

Togetha Group understands the importance of ensuring the privacy of your personally identifiable information and being legally compliant to privacy laws and regulations. For more information, please see our Privacy Policy.