Security and privacy

Rainbook keeps your customer data in your own Atlassian cloud, shows each person exactly what Jira lets them see, and follows your Jira site's data residency.

Trust documents

Trust centre: how Rainbook protects your data, what is stored where, and our security controls.
Data Processing Addendum: our processor terms, ready to sign.
Subprocessors: every service that processes data for Rainbook.
AI Usage Policy: what Rainbook's AI reads, where it runs and what it keeps.
Data Retention: how long each kind of data is kept, and what happens when you uninstall.
Security questionnaire: our answers to the questions security teams ask, ready for your review.
Privacy policy and End User Terms.
Regulated pack: extra controls for regulated teams, available as an optional pack.

Rainbook runs on Atlassian-hosted infrastructure; a third-party penetration test is scheduled for early 2027.

How access works

Anyone Jira lets see a record sees all of it. Rainbook's records are Jira work items protected by Jira's own permission schemes and issue security levels, so Jira search, dashboards, Rovo, the Jira mobile app and Rainbook all show the same records to the same people.
Rainbook's AI sees what you can see. Rainbook's AI runs on models hosted by Atlassian. It reads what you can see in Jira and nothing more. Your data isn't used to train models.
Your data stays in your Atlassian cloud. Rainbook runs no servers of its own that hold customer data. Your records live in Jira, and Rainbook's own data lives in Forge storage on your site.
Rainbook Mail Sync connects to your mail. It reads Microsoft 365 or Google Workspace mail and calendars with the access your IT admin, or each person, approves, and writes customer email onto your Jira work items.

Your whole team sees every customer email on the account and deal; mark a thread Private to keep it to you and the people Jira allows. By default, that means the owner and members of rainbook-admins. A deal owner can make a deal private to the people they choose. See the Admin guide for access settings, private deals and Jira Free.

Data residency

Rainbook stores End-User Data only in Atlassian products and in Forge hosted storage, and both support data residency. When your Jira site is pinned to a location, or you move it to another one, Rainbook's data is hosted in the same location and moves with it.

What Rainbook keeps in Forge storage

Everything Rainbook stores outside your Jira work items sits in Forge hosted storage on your site (Forge SQL, the Key-Value Store, the Custom Entity Store and the Forge Object Store). It is in scope for data residency and follows your Jira site's location:

the people index and email search index, including short message previews and search terms;
the reporting mirror behind Ask, reports and dashboards;
activity history, with older entries in archive files;
AI results (summaries, health reasons, briefs and drafts) and the 30-day traces behind Show sources;
reference data, import maps and imported email history older than 90 days;
settings, saved views and Rainbook's job state;
for Rainbook Mail Sync: mailbox connection tokens, sync cursors, the message ledger and a short-lived capture buffer.

What lives in Jira

Your customer records are Jira work items, so they follow your Jira site's data residency exactly like any other Jira data:

accounts, contacts, leads, deals, renewals, follow-ups and industry-pack records, with all their fields;
email threads and meetings, with full message bodies, senders and recipients, attachments and inline images;
Rainbook's values stored on each work item, which keep your data readable after an uninstall;
the nightly Rainbook Archive item and its archive files.

In-scope End-User Data

Rainbook treats all of the following as in-scope End-User Data. It is stored only in your Jira site or in Rainbook's Forge storage on your site, and the last column says what happens to it if you uninstall (see Uninstall and what you keep).

End-User Data	Where Rainbook stores it	After you uninstall
Contacts and leads: names, email addresses, phone numbers, titles and other details	Jira work items	Kept in Jira
Accounts, deals, renewals, follow-ups, promises and industry-pack records, with amounts, dates, stages, notes and every field	Jira work items	Kept in Jira
Email and calendar content: subjects, bodies, senders, recipients, attendees, attachments, inline images and meeting details	Jira work items (Conversations and Meetings)	Kept in Jira
Your team's Jira account IDs on records, such as owners, account teams and the people a private deal is shared with, and Rainbook's values on each work item	Jira fields and issue properties	Kept in Jira
The nightly Rainbook Archive item and its archive sets	A Jira work item	Kept in Jira
The people and email search indexes: names, email addresses, thread participants, short message previews and search terms	Forge SQL	Removed
The reporting mirror and reporting history: copies of record fields for Ask, reports and dashboards, field changes, daily snapshots, targets and forecast calls	Forge SQL	Removed
Activity history: who changed what, with old and new values	Forge SQL, with older months in archive files in the Forge Object Store	Removed; export it first from Settings › Activity history
Questions people ask Rainbook's AI, and its answers, summaries, health reasons, briefs, drafts and proposals	Forge SQL	Removed
AI traces behind Show sources: the prompt, the sources read and the output, kept for 30 days	Forge SQL and the Forge Object Store	Removed
Files you import from another CRM, import maps and imported email history older than 90 days	Forge SQL and the Forge Object Store	Removed; on sites with the Regulated pack, see its page for what to download first
Privacy requests: the address a request is about, replaced by a fingerprint when the request ends	Forge SQL	Removed
Settings, saved views, delivery templates, blocked addresses and domains, and Rainbook's job state	The Key-Value Store and the Custom Entity Store	Removed
Rainbook Mail Sync's mailbox connections, sync state and message ledger	The Custom Entity Store, with connection tokens encrypted in the Key-Value Store	When you uninstall Rainbook Mail Sync, capture stops and Mail Sync revokes the Google sign-in tokens of people who connected their own Google mailbox, most recently used first. Atlassian deletes the app's Forge-hosted data 28 days after uninstall; a reinstall requested within 21 days can be relinked to that data. Reconnect mailboxes after a reinstall. To end Microsoft 365 organisation-wide consent, remove Rainbook Mail Sync from Enterprise applications in Microsoft Entra.
Rainbook Mail Sync's capture buffer: messages on their way into Jira	The Forge Object Store, briefly	Removed

Atlassian keeps removed Rainbook storage for its standard recovery period and can relink it to a reinstall you request within 21 days.

On sites with the optional Regulated pack, some of this is stored differently; see Regulated pack.

Out of scope

These are not stored in Rainbook's storage, and each carries no record content unless stated:

Product analytics (PostHog): pseudonymous site and user IDs, screens, features used and timings. Error reports (Sentry): the error's type and stack frames and a scrambled site ID, with no person identifier. Neither carries any of the in-scope data above.
App logs in Atlassian's Forge platform: Atlassian account IDs, your site's cloud ID and host, and record keys, kept for 30 days. Never names, email addresses, subjects, message bodies, file names, field values, prompts or AI output.
AI processing. Rainbook's AI runs on models hosted by Atlassian, in Atlassian's AI processing locations, under the Atlassian terms that govern them. The results are stored in your Jira site and Rainbook's storage, as above.
Your mail provider. Rainbook Mail Sync reads mail and calendars from your own Microsoft 365 or Google Workspace tenant, where your provider keeps them.
The Gmail and Outlook sidebars. The Gmail add-on runs on Google Apps Script and the Outlook add-in runs in Outlook. They show record details to the person using them and keep only a pairing token, never record data.
Company logos. Rainbook Mail Sync sends a company's web domain, and nothing else, to logo.dev to fetch its logo, which Rainbook then stores on the account in Jira. Logos by Logo.dev.
The Rainbook website. rainbook.humanr.ai hosts these pages and the add-in files and holds no customer data.
Integrations your admin turns on, from January. Salesforce, HubSpot and Pipedrive (imports), Apollo and People Data Labs (enrichment, with your own key), and the European Central Bank and SAM.gov (reference data). Each stays off until an admin turns it on; see Subprocessors.
Connections your admin adds in a later release. Slack and Microsoft Teams (alerts), Zapier and Make (automations), Brave Search (web search) and Anthropic, OpenAI or Microsoft Azure AI (Azure OpenAI or Azure AI Foundry) (AI on your own key). Each uses your organisation's own account or key, and nothing is sent until your admin connects it.
Diagnostics you choose to share with Rainbook support leave your site only through your own browser, when you attach them to a support request.

Product analytics and error reports

Rainbook sends usage analytics to PostHog and error reports to Sentry so we can see which features help you and fix problems quickly. Analytics events carry screens, features used and timings, keyed by pseudonymous site and user IDs. Error reports carry the error's type and stack frames and a scrambled site ID, and nothing that identifies a person. Neither ever carries names, email addresses, record content or prompts, and error reports are scrubbed before they leave.

Analytics are on when you install. Your admins can switch them off in Atlassian's admin controls, and every Rainbook feature works the same with them off.

Card and SSN masking

Rainbook masks payment card numbers and US Social Security numbers everywhere it writes: captured email bodies and subjects, messages logged from the sidebars, calendar events, imports, Rainbook's forms and AI output. A card number becomes "[card ending 4242 removed]" and a Social Security number becomes "[SSN removed]" before anything is saved, and the rest of the message is kept.

Settings › Privacy and data shows how many numbers Rainbook removed this month. Masking is always on. It covers the text Rainbook writes; attachments and edits people make directly in Jira aren't scanned.

Rainbook is built for customer relationships, not for health records, government identifiers or other special-category data, and the end user terms don't allow storing it. Teams in healthcare, government and other regulated fields add the Regulated pack on Advanced (early access from 15 Dec 2026), whose detectors keep that data out of captured email, files and imports.

Report a vulnerability

If you find a security issue in Rainbook or Rainbook Mail Sync, tell us at security or email security@rainbook.humanr.ai. We acknowledge every report and keep you updated until it's fixed. For privacy questions and data requests, email privacy@rainbook.humanr.ai.