Summary
Pact (“the App”) is an Atlassian Forge app that participates in Atlassian's Runs on Atlassian program. It runs entirely inside your Atlassian cloud environment. It does not send your data to Hullara's servers or to any third party — there are no external servers, no analytics calls, and no data egress.
Data we access
The App reads only the data required for its features, using the granted Atlassian scopes:
| Scope | Why it is needed |
|---|---|
read:jira-work | Read your Jira issues and their change history — to compute working-time SLA state (elapsed, remaining, at risk, breached) per policy. |
send:notification:jira | Email the reporter and assignee on at-risk and breach events, using Jira's own in-tenant notification queue. These emails are sent by Jira, not by an external mail service. |
storage:app | Store your SLA policies and settings. |
It accesses this data on your behalf, within your Atlassian tenant, and only to compute and deliver the features you use.
Data we store
To evaluate SLAs and avoid duplicate alerts, the App stores app configuration — the SLA policies you define (statuses, working-hour budgets, calendars, notify settings) and small per-issue records: a notification-state marker (which alert has already been sent) and, while an issue's SLA clock is running, the issue key and the time of its next scheduled check — plus, per project, the last compliance report you ran: the per-policy tally and, for up to 200 breached issues, the issue key, summary, policy name and breach time. All of it lives in Atlassian-hosted Forge storage, which lives inside your Atlassian cloud environment and inherits its data-residency region. We do not copy your data outside Atlassian.
Data we do not collect
We do not sell, rent, or share your data. We do not use it for advertising or to train machine-learning models. We do not receive a copy of it — it never leaves your Atlassian tenant. The App does not integrate Slack, webhooks, or any external destination.
Sub-processors
None beyond Atlassian itself, the platform hosting the App. Because the App runs on Atlassian with no egress, no additional sub-processors are involved. At-risk and breach emails are delivered by Atlassian's own Jira notification system.
Security
The App inherits Atlassian's platform security controls, including SOC 2 Type II and ISO/IEC 27001, and Atlassian's data-residency options. SLA state is computed from the issue changelog on demand using the App's granted read access within your tenant.
Data retention and deletion
Policy and notification-state data is stored only while the App is installed. Uninstalling the App removes the App's stored data from your Atlassian environment.
Children
The App is a business tool and is not directed to children under 16.
Changes
We may update this policy; material changes will be reflected here with a new effective date.
Contact
Questions or data requests: [email protected]