No sensitive personal information

David Mattox_wzgig8

We are looking at moving from our current platform to Jira Service Management, however, we are stuck with the provision in the TOS which does not allow Sensitive Personal Information. 

As it is difficult to control what users do when submitting tickets, this seems to really limit who can use JSM in the cloud. Has anyone come up with an approach to handle this? If the only option is internal hosting, we will remain on our current ITSM solution.

5.3. No Prohibited Sensitive Personal Information. You will not submit to the Cloud Products
(or use the Cloud Products to collect) any Sensitive Personal Information unless its processing is expressly supported as a feature of the applicable Cloud Product in the applicable Documentation. Notwithstanding any other provision to the contrary, we have no liability under these Terms for Sensitive Personal Information submitted in violation of the foregoing

Mark Segall

Hi @David Mattox and welcome to the community!  I think it depends upon what type of PII you're looking to capture. The key to that section you shared is this:

unless its processing is expressly supported as a feature of the applicable Cloud Product in the applicable Documentation.

Any application that is designed for customer interaction will require name/email.  JSM is no different.  Nothing else is stored unless you create custom fields to do so.  Stating that, I would think about policies like this:

• Isolated Instance - If you have the potential for multiple types of JSM projects, you probably need a separate instance for the project(s) that require more intense scrutiny.
• Strict controls on Jira Admins/Agents - Both have the right to add/view customers (instancewide) so you should be very restrictive on who is set up in these roles
• On/Offboarding - Establish how customers are onboarded and ultimately removed/renamed