Data Encryption
All secure field data is encrypted with AES-256. Encrypted data is stored entirely within Atlassian's cloud infrastructure and never leaves it. There is no separate data store outside Atlassian's own environment.
Certifications
Ricksoft, Inc. holds ISO 27001 certification, the international standard for information security management systems (ISMS). This certification covers the organizational security practices governing how Secure Custom Fields for Jira is developed, operated, and supported.
Independent Security Testing
Secure Custom Fields for Jira is actively enrolled in the Atlassian Marketplace Bug Bounty program. This means independent security researchers continuously test the app for vulnerabilities, on an ongoing basis rather than a one-time audit.
Access Control
Field-level permissions are configured by Jira administrators, controlling exactly who can view or edit each secure field's value. Protected fields are displayed as read-only or hidden to any user without explicit permission.
AI / Rovo Capability
Secure Custom Fields for Jira is built so AI-assisted work through Rovo respects the same permission model as the rest of the app, access is never widened for convenience:
-
No more dead ends on access denial. Today, if Rovo denies a user access to a secure field, they're stuck, they have to track down an admin manually, outside both Jira and Rovo. With this capability, Rovo instead offers to request access on their behalf, right from the chat, and routes it to the field's admins for approval. Rovo never reveals who currently holds access, even if asked directly (Coming soon!)
-
Full AI analysis for the people who are already allowed to see it. Users with legitimate view permission get the same Rovo-powered summarization, trend-spotting, and cross-issue analysis that every other Jira field already gets — nothing is held back from them. Anyone without permission is simply excluded from the results, silently, with no data leaked (Coming soon!)
The pitch to a security-conscious buyer: locking down your data doesn't mean losing AI , permitted users get full value, unauthorized users get nothing, and the boundary is never crossed either way.
Questions
For security or compliance questions beyond what's covered here, contact us via the support portal or reach out directly during your demo.