Security - Khyo Labs

Scope

This policy covers Khyo Labs apps on the Atlassian Marketplace, currently Khyo Chat Alerts for Jira and Zoom Team Chat and Khyo Chat Alerts for Jira and Google Chat.

How the apps are built

The apps run on Atlassian Forge. All app code runs on Atlassian's infrastructure; Khyo Labs operates no servers of its own for these apps.
App settings, notification rules, webhook secrets and the recent delivery log are stored in Forge storage inside Atlassian. Webhook URLs and tokens are stored encrypted using Forge's encrypted secret storage.
The only data that leaves Atlassian is the notification content a customer admin configures, sent over HTTPS to that customer's own Zoom Team Chat or Google Chat destination. The apps declare these egress hosts in their Forge manifest: integrations.zoom.us (Zoom Team Chat app) and chat.googleapis.com (Google Chat app). No other outbound hosts are allowed.
The apps request only the Jira permissions (scopes) needed to read issue events and send notifications: read:jira-work and read:jira-user. The apps cannot write to Jira.

Reporting a vulnerability

Email security@khyo.com. Please include the app name, steps to reproduce, and impact.
Please don't publicly disclose an issue until we have released a fix.
Vulnerabilities can also reach us through Atlassian's Marketplace Security program (AMS) and the Marketplace Security Bug Bounty.

Our response commitments

We acknowledge reports within 2 business days.
We fix confirmed vulnerabilities within Atlassian's required timeframes for Marketplace Cloud apps: Critical (CVSS 9.0+) within 10 days, High (7.0+) within 4 weeks, Medium (4.0+) within 12 weeks, Low within 25 weeks.
Because the apps run on Forge, fixes deploy to all customers automatically.

Data handling

See our Privacy Policy at labs.khyo.com/privacy.

When an app is uninstalled, Forge-hosted storage (Key-Value Store, Custom Entity Store, Forge SQL, Object Store, and secrets) is soft-deleted and retained for up to 28 days. Within 21 days of uninstall, a developer can request Atlassian to re-link the previous installation's data; after the 28‑day retention period, the data is permanently deleted. See Atlassian's docs: Forge storage reference and Data lifecycle for Forge-hosted storage.

Contact