Syncotta logoGet notified at launch

Security and data handling

Answers for security reviewers on one page: where Syncotta runs, what it accepts, what it stores and which Jira permissions it uses.

Data flow

Syncotta data flowArgo CD Notifications, the PreSync gate Job and CI send requests from your cluster to Syncotta, a Forge app inside Atlassian Cloud. Syncotta writes to Jira. The only reply into the cluster is the gate response.Your clusterArgo CD NotificationsPreSync gate JobCI (GitHub Action)Atlassian CloudSyncottaForge apptriggers · queue · storageJiraDeployments panelChange requestsevents (token)gate check (HMAC)gate answerCI metadata (HMAC)Syncotta never connects to Argo CD, Git or Kubernetes.
The only reply into the cluster is the gate's answer: allowed, awaiting or prevented.

Facts

TopicStatement
PlatformAtlassian Forge app. Code and data run on Atlassian infrastructure.
EgressThe app makes no calls to non-Atlassian hosts.
InboundThree routes on two Forge web triggers: deployment events, CI metadata and gate checks.
AuthenticationDeployment events: bearer token. CI and gate requests: HMAC-SHA256 over timestamp, nonce and body; ±5 minute window; nonces kept 10 minutes to block replays.
SecretsStored in Forge secret storage, never in URLs or logs.
Stored dataPer-site settings, gate state, recent nonces, image-to-issue mappings. No source code. Commit messages are used for issue key extraction and not logged.
Reporting issuessecurity@syncotta.com

Jira permissions (OAuth scopes)

Draft. The final list is copied from the app manifest at launch.

ScopeWhy
read:deployment-info:jiraRead deployment records and gating status for gate checks.
write:deployment-info:jiraSend Argo CD deployments to Jira.
delete:deployment-info:jiraRemove deployment records the app created.
read:jira-workRead issue status for Standard mode gates and react to issue updates.
write:jira-workCreate and update gate issues in Standard mode.
storage:appKeep settings, gate state and nonces in Forge storage.