Security & data residency
Quartz runs entirely on Atlassian Forge: there is no external backend, no data egress, and every view is scoped to what each user can already see in Jira.
Where your data lives
Quartz has no server of its own. All configuration and state live in Atlassian Forge storage (storage:app), and every read of issue data happens inside the Forge runtime to compute SLA status. Issue data never leaves Atlassian's cloud — there is no outbound webhook, no third-party API, and no Quartz-hosted database.
SLA status is computed on demand and is never stored. Quartz keeps no separate timer database of elapsed time — nothing is backfilled, so there is no shadow copy of your issues to secure.
Forge scopes and what each is for
Quartz requests a small, fixed set of Forge scopes. The first time you install (or after a scope change), Jira shows them for review.
| Scope | Why Quartz needs it |
|---|---|
read:jira-work | Read issue data to compute SLA timers and reports. |
write:jira-work | Write Quartz's own SLA values back into the Jira fields you map (deadline, time remaining, status, and so on). |
manage:jira-configuration | Create a Jira custom field on request, when you choose "create a field" instead of mapping an existing one. |
read:jira-user | Resolve actor and assignee ids to display names, and check your group membership for permissions. |
storage:app | Store SLA definitions, calendars, settings, saved views, and the audit log in Forge storage. |
Quartz only ever writes its own SLA values back into the fields you explicitly map — it does not modify issue content. The write scopes exist for the field write-back and field creation; everything else is read-and-compute.
See SLA Fields for exactly which values are written, to which fields, and how to use existing fields instead of creating new ones.
User-scoped access
Quartz never broadens what a person can see. Every Radar, Reports, Forecast, gadget, and Rovo view runs as the requesting user, so Jira itself filters results to the issues that user is allowed to browse. "Open by default" for the Radar and Reports views means everyone may open those screens — not that everyone sees the same issues.
Administrative actions are checked against the caller's own Jira admin permission, and group membership is read from the caller's own profile. Manage capabilities are restricted by default; view capabilities are open by default but still scoped per user. See Permissions for the full matrix.
What data is processed and why
| Data | Used for | Stored? |
|---|---|---|
| Issue data | Computing SLA status, progress, and reports on demand | No — computed each time, never stored |
| SLA definitions, calendars, settings | Your Quartz configuration | Forge storage |
| Mapped SLA values | Written back into the Jira fields you choose | In Jira (as field values) |
| Actor / assignee ids and display names | Showing who did what; resolving names in the grid and audit log | Names resolved at display time |
| Audit entries (actor, action, target, time) | Immutable change trail and Governance review | Forge storage |
The Audit log records configuration and exception changes — SLA, calendar, permission, settings, mute, extend, and field changes. It is recorded in Atlassian and never sent anywhere.
Exports stay in the browser
CSV export from Reports is generated in your browser and matches the visible, filtered rows exactly. There is no web trigger and no server round-trip — the data never leaves your machine through Quartz.
AI features and Atlassian-hosted Claude
All AI features are Advanced only; Standard has none. Every AI feature runs on Atlassian-hosted Claude inside the Forge runtime, so prompts never leave Atlassian and nothing is sent to a third-party model provider. AI is used only to produce plain-language summaries and explanations of your SLA data.
Fit for compliance teams
Because there is no external backend, no data egress, and even the AI stays on Atlassian-hosted Claude, Quartz is "one less vendor to assess" for teams under ITIL, ISO/IEC 20000, or SOC 2. The in-app Compliance view maps SLAs onto control clauses, but it reports instrumentation coverage — that a timer is in place — and is explicitly not a certification, attestation, or audit.
Privacy policy
Quartz is published by Plugin Developers. Personal information is never sold, rented, or disclosed to third parties except as required by law. For the full statement, see the Quartz privacy policy or contact support@plugin-developers.com. The support portal is at plugin-developers.atlassian.net.
Was this page helpful? Yes · No · Contact support