Gatetrail

Data residency

Gatetrail runs on Atlassian Forge and has no backend of its own. Everything it stores is in the Forge Key-Value Store, including its secret store, and is in scope for data residency: it follows the residency of your Jira site (Forge data residency, Key-Value Store). Tickets, comments and issue properties are Jira data and follow Jira.

In scope: Forge key-value store

  • Bindings: SonarQube™ project key, Jira project key, issue type, labels, field defaults, minimum severity, auto-close and SLA days.
  • Ticket links: fingerprint, Jira issue key, group (rule key, file path or SonarQube issue key), content hash, analysis time.
  • Quality gate links: issue key, SonarQube task ID, time, hash.
  • Sync state per project and branch; project overviews, trends and security summaries.
  • Settings: approver group name; SonarQube sources; public decision keys.
  • Decision log: issue key, decision, reason, approver account ID (no name), time, signature, SonarQube target.

In scope: Forge secret store

Webhook and relay secrets per source and the private decision signing key, stored encrypted in the secret store of the Forge Key-Value Store. They are not End-User Data.

In your Jira site

  • Tickets with summary and description: rule name, file paths, lines, SonarQube messages, links to your SonarQube, due date, effort.
  • Issue properties sonarGroup and sonarDecision.
  • Comments from the deadline check and decisions, the label sla-breached, the due date.

Processed, not stored

Webhook payloads (project, branch, gate conditions, server URL) and relay deliveries, except for what is listed above.

After uninstallation

Uninstalling the app deletes its stored data (configuration, secrets, sync state, overviews and the decision log) according to Atlassian's data lifecycle for Forge hosted storage. A reinstall starts empty and needs new secrets in SonarQube and your CI. Atlassian retains the deleted storage for 28 days and then erases it (Forge storage overview). Within 21 days of uninstallation, we can ask Atlassian to relink it to a new installation, only with your consent; this is not automatic and may not succeed, so export the decision log as CSV before uninstalling. Tickets, comments and issue properties are Jira data and stay in your site.

Out of scope

  • App function logs, hosted by Atlassian for 30 days.
  • Licensing data that Atlassian shares with us as the app vendor (see the privacy policy).
  • Data the relay processes in your CI; it stays in your systems.