8lax, no end of ideas

Work / Attestly / Privacy policy

Attestly privacy policy

Last updated 4 September 2026 · Applies to Attestly for Jira Cloud · help@8lax.com

Every 8lax product has its own policy, at 8lax.com/works/[product]/policy. This one covers Attestly and nothing else. Our products run on different infrastructure and handle data differently, and a single policy stretched across all of them would have to be written vaguely enough to be useless. The notice for the website itself is at 8lax.com/privacy, and the terms for using Attestly are at 8lax.com/works/attestly/terms.

1. Who this covers

8lax is the trading name of ФОП Литвин О. В., registered in Ukraine. Attestly is an Atlassian Forge app for Jira Cloud, published by 8lax. It runs inside Atlassian's own infrastructure, on your Atlassian site, rather than on servers of ours.

2. Where your data goes: nowhere

Attestly declares no external egress. Its manifest contains no permission to fetch an external address, and a test in the source refuses to build if one is added.

  • No data leaves Atlassian infrastructure.
  • No third-party processor, analytics provider or sub-processor.
  • No AI and no language model. Your data is not sent to any model, ours or anyone else's, for any purpose including training.
  • Data residency follows your Atlassian site's own region, because the storage is Atlassian's.

This is what makes the app eligible for Atlassian's Runs on Atlassian programme. Eligibility is determined by Atlassian against the app's declared permissions, not asserted by us, and it is eligibility, not a badge we have been awarded.

3. What it reads from Jira

Only what an access review needs, and only by reading:

  • projects, their keys, names and leads
  • permission schemes and their grants
  • project roles and their actors
  • group membership
  • user account IDs, display names, account types and whether an account is still active

Attestly holds read-only scopes. It has no write, manage, delete or admin permission of any kind and cannot change a permission in Jira.

4. What it stores

In Forge storage attached to your site:

  • Snapshots: account IDs, project IDs, permission names, and how each access was granted
  • Campaigns and assignments: campaign name, scope, due date, reviewer account IDs
  • Decisions: outcome, the written justification your reviewer typed, who decided, and when
  • Evidence log: the hash-chained record of the above

Display names and account types are never stored. They are read from Jira each time a screen renders or a pack is exported, and the exported pack stamps that moment.

Justifications are free text written by your reviewers. Whatever they type is stored and appears in the evidence pack, so tell them not to put anything there that does not belong in an audit record.

5. What we, the publisher, can see

App logs. Atlassian enables log sharing with app developers by default when an app is installed, and those logs appear in our developer console. You can turn this off in your Atlassian admin.

We deliberately keep personal data out of those logs. They contain identifiers, project keys, counts, elapsed times, hash prefixes and error messages. A test in the source fails the build if a log statement is added that would print an account ID, a display name, a group name or text typed by one of your users.

Nothing else. We have no other channel to your data. We cannot read the records the app creates for you; they are in your site's storage, not ours.

6. Sharing

We do not share your data with anyone, because we do not have it.

An exported file leaves the system only when a person in your organisation downloads it. From that moment it is an ordinary file under your control, and whom you send it to is your decision.

7. Retention and deletion

Data lives in your site's Forge storage until you remove it, either from inside the app or by uninstalling it, at which point Atlassian removes the app's storage.

Some records are deliberately kept when you might expect deletion. A cancelled access review keeps its decisions and its evidence, because a review that can be made to disappear is not evidence. Uninstalling removes it along with everything else.

  • Delete a snapshot from the Snapshots screen. The app refuses if a campaign still needs it.
  • Cancelling a campaign does not delete it.
  • Uninstalling the app removes its storage entirely.

8. Your rights

Because the data sits in your Atlassian tenancy and we hold no copy, requests for access, correction, export or erasure are served from your own site by your own administrators. Write to help@8lax.com if you need help doing so and we will help you find it.

9. Security

  • Read-only scopes: the app's job does not require writing, so it cannot.
  • No egress, so there is nothing in transit to a third party to intercept.
  • Authentication, authorisation, encryption and residency are Atlassian's, inherited by every Forge app.
  • The evidence record is described as tamper-evident and not as immutable. Each entry hashes the one before it, so altering one breaks every hash after it, and anyone able to write to the underlying storage could recompute the chain. We say this plainly rather than claiming more.

10. Changes

Material changes will be reflected here with a new date and noted in the app's Marketplace release notes.

11. Contact

help@8lax.com for privacy questions, data requests, and anything else.