Security

Umedrop builds small apps for Atlassian cloud products. This page explains how our apps protect your data and how to report a security issue.

• How our apps run. Business Day Due Dates runs entirely on Atlassian Forge. It stores only its settings in Forge hosted storage, in the same data residency location as your Jira site, and makes no requests outside Atlassian. It does not store personal data. See the privacy policy for details.
• Reporting a vulnerability. Email security@umedrop.com with the app name, the steps to reproduce the issue and its impact. Please do not include personal data or customer data. We acknowledge reports within 5 business days.
• Fixing vulnerabilities. We fix vulnerabilities within the timeframes of Atlassian's Security Bug Fix Policy for Marketplace apps: critical (CVSS 9.0 or higher) within 10 days, high (7.0 or higher) within 4 weeks, medium (4.0 or higher) within 12 weeks and low within 25 weeks. Fixes are delivered as app updates through Atlassian.
• Security incidents. If a security incident affects your data, we will notify Atlassian and affected customers.