Rainbook security

How the apps are built

• Rainbook makes no network call outside Atlassian.
• Rainbook Mail Sync is a separate app that alone talks to Google and Microsoft, with read-only mail and calendar permissions. The two apps share no storage; they exchange signed settings through Jira.
• Every request to the apps checks the caller, the licence and Jira permissions first, and refuses when a check cannot complete.
• Every read of Rainbook's own storage is filtered by Jira permissions and security levels, so reports, the sidebars and AI never show a record a person cannot open in Jira.

For security and compliance teams

• The Advanced edition adds an immutable, hash-chained audit export, retention schedules, protected fields on restricted Confidential records and regulated mode, which keeps email bodies, files and AI summaries off Jira.
• Security questionnaires, the data processing agreement and our policies: security@rainbook.humanr.ai.

Report a vulnerability

Email security@rainbook.humanr.ai. In scope: Rainbook, Rainbook Mail Sync, Rainbook CRM for Gmail, Rainbook CRM for Outlook and this website. We acknowledge a report within two business days and tell you what we will fix and when.