Security and trust: Merge Duplicate Requests

A short page for your security review. Details are in the privacy policy.

Where it runs

• Built on Atlassian Forge and eligible for the Runs on Atlassian program: all code runs on Atlassian's infrastructure and all app data is stored in your site's Forge storage, in the same data region as your Jira site.
• No external calls. The app has no servers of its own and sends no data anywhere: no analytics, no email, no webhooks.
• Uninstalling removes the app; Atlassian deletes its stored data 28 days later.

Who can do what

• Agents merge with their own Jira permissions: the app makes every change as the agent who clicked, so it can never do more than that agent could do by hand.
• Jira admins change the settings. The admin check runs on the server on every call.
• Customers never see the merge actions or internal notes; they see only the public reply on their request and the main request they were added to.
• The only automatic action (passing on a customer's reply to a merged request) adds an internal note and nothing else.

Safety of merges

• A preview shows exactly what will happen before anything changes.
• Every change is recorded as it happens, so Undo can reverse exactly what was done, even if a merge stopped part way.
• Requests can't be merged into themselves, across service projects, or merged twice into different requests.

What it stores

Settings and a record of each merge with Atlassian account IDs, request keys and the IDs of what the merge created. No names, emails or request content. Account IDs are reported to Atlassian weekly and erased when an account is closed. See the privacy policy.

Permissions it asks for

Each permission and why is listed in the privacy policy.

Support

support@stacix.com, replies within 1 business day (Monday to Friday, India time, UTC+5:30).