RainbookRainbook security and privacy answers
Short answers to the questions security teams and the Atlassian Marketplace ask, for Rainbook and Rainbook Mail Sync. For anything not covered, write to security@rainbook.humanr.ai.
Marketplace privacy and security answers
| Question | Rainbook | Rainbook Mail Sync |
|---|---|---|
| Stores your data outside Atlassian? | No | No: tokens, sync progress and its message ledger are in Forge storage. The add-ins keep a pairing token in your own mail account, and the Gmail add-on caches the card it shows for up to 10 minutes |
| Processes your data outside Atlassian or your browser? | No | Yes: mail and calendars are read from your own Google Workspace or Microsoft 365, and the Gmail add-on runs on Google Apps Script. Data: names, email addresses, the record fields shown in the sidebar and message content |
| Logs your data? | Yes: Atlassian account IDs, the cloud ID, site host and record keys, in Atlassian's Forge logs only; never names, email addresses, subjects, bodies, file names, field values, prompts or AI output | Same |
| Logs your data outside Atlassian? | No: app logs stay in Atlassian's Forge logs. Error reports go to Sentry with the error type, an error message stripped of names, addresses and content, stack frames and a scrambled site ID only, never a person, name, email address or record content | Same |
| Shares logs with third parties? | No logs that include your data: Sentry receives error reports with the error type, an error message stripped of names, addresses and content, stack frames and a scrambled site ID only; admins switch them off in Atlassian's admin controls | Same |
| Exposes remote APIs? | Yes: one web endpoint with fixed replies that accepts signed messages from Rainbook Mail Sync only, authenticated with a per-site shared secret: capture status and settings, blocked addresses, "keep this thread private" requests, threads logged from the Gmail or Outlook sidebar, company logos, connection checks and activity-history notes. The two apps pair through Jira, not through this endpoint | Yes: one web endpoint for the Gmail add-on and the Outlook add-in, authenticated by per-user pairing tokens, and the sign-in return page for connecting mailboxes |
| Shares your data with third parties? | No: AI runs on Atlassian-hosted Forge LLM. Usage analytics (PostHog) carry pseudonymous IDs and no record content; error reports (Sentry) carry the error type, a scrubbed error message, stack frames and a scrambled site ID only | Google and Microsoft, acting for you; logo.dev receives a company's web domain only; PostHog and Sentry as for Rainbook. From January 2027, only when your admin turns each on: Salesforce, HubSpot and Pipedrive imports, Apollo and People Data Labs enrichment on your own key, the European Central Bank's exchange rates and SAM.gov. In a later release, only when your admin connects your own account or key: Slack and Microsoft Teams alerts, Zapier and Make automations, Brave Search web search, and Anthropic, OpenAI or Microsoft Azure AI (Azure OpenAI or Azure AI Foundry) AI on your own key |
| Data residency | Yes: the app stores your data only in Atlassian products and services that support data residency | No: what it keeps in Forge storage (its mailbox connections and tokens, sync progress, the capture ledger and the messages and files waiting to be written) and the captured email and meetings in your Jira work items follow your site's region, but Mail Sync isn't pinned to a location, because it reads mail and calendars through Google's or Microsoft's services |
| Keeps data after uninstall? | Your records, captured email with its files and every field stay in Jira as work items. The app's Forge storage is deleted by Atlassian after its recovery period; Atlassian can reconnect it to a reinstall requested within 21 days | When you uninstall Rainbook Mail Sync, capture stops and Mail Sync revokes the Google sign-in tokens of people who connected their own Google mailbox, most recently used first. Atlassian deletes the app's Forge-hosted data 28 days after uninstall; a reinstall requested within 21 days can be relinked to that data. Reconnect mailboxes after a reinstall |
| Custom retention on request? | Yes: on Advanced, admins choose how long activity history is kept | No |
| Privacy-enhancing technologies? | Yes: payment card numbers and US Social Security numbers are masked before storage wherever Rainbook writes text (imports, Rainbook's forms and AI output; not attached files, file names, images or text typed directly in Jira's own screens); every screen shows a record only to people Jira lets see it | Yes: card and Social Security numbers in captured and logged email and calendar events are masked in place before they are written (attached files, file names and images are not scanned); each person's never-log list and the admin's block lists, by address or domain, keep every message with a listed person out; Private threads (Jira Standard and above); pseudonymous analytics IDs, and one-way hashes for the capture ledger, pairing tokens and erased people |
| Data controller under GDPR? | No, processor | No, processor |
| Trust centre | https://rainbook.humanr.ai/trust | Same |
What each app declares
The permissions, outbound connections, storage and endpoints in each app's manifest:
| Rainbook | Rainbook Mail Sync | |
|---|---|---|
| Jira permissions | read:jira-work, read:jira-user, read:email-address:jira, read:servicedesk-request, manage:servicedesk-customer, write:jira-work, manage:jira-project, manage:jira-configuration, read:license:jira, read:application-role:jira, read:app-data:jira, write:app-data:jira, read:object:jira, write:object:jira, delete:object:jira, redact:issue:jira, storage:app, report:personal-data | read:jira-work, write:jira-work, read:jira-user, read:group:jira, read:user:jira, read:avatar:jira, storage:app, report:personal-data, write:app-data:jira |
| Outbound connections | *.posthog.com, *.ingest.us.sentry.io | *.webtrigger.atlassian.app, login.microsoftonline.com, graph.microsoft.com, oauth2.googleapis.com, gmail.googleapis.com, admin.googleapis.com, www.googleapis.com, www.ecb.europa.eu, login.salesforce.com, test.salesforce.com, *.my.salesforce.com, *.salesforce.com, api.hubapi.com, api.hubspot.com, api.pipedrive.com, oauth.pipedrive.com, *.pipedrive.com, api.apollo.io, api.peopledatalabs.com, api.sam.gov, img.logo.dev, hooks.slack.com, *.environment.api.powerplatform.com, hooks.zapier.com, *.make.com, *.make.celonis.com, api.search.brave.com, api.anthropic.com, api.openai.com, *.api.openai.com, *.openai.azure.com, *.services.ai.azure.com, *.cognitiveservices.azure.com, *.posthog.com, *.ingest.us.sentry.io |
| Connections from the browser | *.posthog.com, *.ingest.us.sentry.io | *.posthog.com, *.ingest.us.sentry.io |
| Storage | Forge SQL, Forge Object Store, Forge key-value storage | Forge SQL, Forge Object Store, Forge key-value storage, with tokens as encrypted Forge secrets |
| AI | Forge LLM (Claude models hosted by Atlassian) | Forge LLM (Claude models hosted by Atlassian) |
| Web endpoints | One endpoint with fixed replies, which accepts signed messages from Rainbook Mail Sync only | The sign-in return page for connecting Google and Microsoft mailboxes. The Gmail add-on's and the Outlook add-in's connection, authenticated by per-user pairing tokens |
Life sciences Open Payments contact data (design partners)
These are personal data of health-care professionals entered by the customer. The six Jira Contact fields are provisioned only with the installed Life sciences pack's design-partner release enabled. Each field follows the Contact's retention, permissions, erasure and export rules. Removing a pack leaves customer values in Jira; its existing clean-up can remove unused fields after an app-side usage count.
| Field name | Purpose | Retention |
|---|---|---|
| HCP first name | HCP first name for the CMS recipient record | The Contact's |
| HCP last name | HCP last name for the CMS recipient record | The Contact's |
| HCP business address line 1 | Primary business street address for CMS reporting | The Contact's |
| HCP business city | Primary business city for CMS reporting | The Contact's |
| HCP business state | Primary business state for CMS reporting | The Contact's |
| HCP business ZIP | Primary business ZIP code for CMS reporting | The Contact's |
The Open Payments export reads Jira as the signed-in admin and builds the file in the browser. Additional CMS registration and recipient classification details entered for a download stay in browser memory until the panel closes; they are not stored by the app. Downloaded files remain on the customer's device until the customer removes them. No new external connection or app storage is used.
Security programme
| Question | Answer |
|---|---|
| Certifications | Rainbook runs on Atlassian's certified cloud platform; Rainbook holds no SOC 2 or ISO 27001 certification of its own |
| Penetration testing | An independent penetration test in January and February 2027; the summary letter is shared when complete |
| Vulnerability reporting | security@rainbook.humanr.ai; acknowledged within two business days |
| Fix times | Critical within 10 days, high 4 weeks, medium 12 weeks, low 25 weeks, matching Atlassian's cloud deadlines |
| Incident notification | Within 72 hours of confirming an incident that affects your data |
| Encryption | At rest with AES-256 in Atlassian's Forge storage; in transit everywhere; tokens as encrypted Forge secrets |
| Tenant isolation | Forge storage per site; a request for one site never reads another site's data |
| Authentication | Atlassian sign-in for every user; the apps store no passwords |
| Access control | Jira permissions and security levels on every read; your Jira admins run Rainbook's settings; imports, activity history, exports and privacy requests need the rainbook-admins group; both checked live; admin rights never bypass security levels |
| Staff access | No standing access to customer data; support works from diagnostics an admin chooses to share |
| Audit trail | Activity history: 13 months searchable on every edition, CSV export; longer on Advanced |
| Erasure and export | By email address, including people who never used Rainbook |
| Subprocessors | The subprocessor list, with 30 days' notice of changes |
| Data processing agreement | The DPA, with EU Standard Contractual Clauses and the UK addendum |
| Support | support@rainbook.humanr.ai, Monday to Friday, 09:00 to 17:00 New York time, except US federal holidays; first response within one business day, Monday to Friday, and within 2 hours, around the clock, for critical issues |