What is stored

Inside Jira. No servers. Dueline reads Jira as you and writes only its own reminder comments, never a field. It runs on Atlassian Forge with no servers of its own.

Permissions

Dueline asks for four:

• read:jira-work: to read your own permissions, to tell whether you are a Jira administrator, and the key, summary and space of the qualified work items you may browse, for the register and the gadget;
• read:jira-user: to read your own groups, a person’s display name and the site’s group list, for the response team;
• storage:app: to keep the settings and each work item’s record in Forge storage;
• write:jira-work: for one call only, to post its reminder comment on a work item, as the app, so Jira shows it written by “Dueline”. On Jira Service Management the comment is internal, so a customer never sees it.

It edits no field of a work item and changes no setting in Jira.

What it stores

Everything is in Forge storage, hosted by Atlassian:

• the site’s settings: the rules that apply, the country, the two DORA and NIS2 answers and the response team (account ids of people, id and name of groups);
• a record for each qualified work item, kept under its id: when the organisation became aware, when it was qualified and by whom, the answers that chose the rules, and each report recorded as sent, fix available or incident handled, with when, who and the reference a person wrote.

It never stores a work item’s summary, description or any field. A reference is at most 100 characters: put the authority’s case number in it, never personal data.

What was reminded

For each work item with a reminder, one more entry, dueline:reminded:<work item id>: the id of each report reminded, whether it was the reminder before the deadline or the one after, the deadline’s time and when the comment was posted, at most 60 entries. It holds no summary, reference or person, and is kept apart from the record, because a reminder is not evidence. The comment itself lives in Jira as a normal comment by the app. It is deleted like any comment, by someone who may delete it, or with the work item.

The review request

Once the listing is public, a “Review Dueline” link on the settings page and a banner on the register pages. For each person it keeps their account id, how many times they opened the app (up to five) and whether they dismissed the banner. Until then nothing is stored.

The register

The register reads each qualified work item’s key, summary and space from Jira as you, when the page opens. It lists only the work items you may browse and stores none of what it reads. It keeps one thing per person: the scope you last showed (spaces, a saved filter or a JQL search), under your account id, so the page opens on it. It is deleted 90 days after it last changed. Download Excel and Download CSV are made in your browser from the rows on screen.

Append-only

A record is never edited or deleted. A correction is a new entry that names the one it corrects, and the corrected one stays in the record, so the record shows what was entered and when. A record holds at most 200 entries.

Deadlines are not stored

They are worked out again every time the panel is shown, from the times above.

How long

Until the app is uninstalled. Then Atlassian keeps its storage for 28 days and deletes it. The full policy is on the privacy page.

Where it goes

Nowhere. There is no network request to anything outside Atlassian, and no tracking. Dueline sends no report to any authority: you do.