Where does a Third Party app "live"?

Ben R

This feels like a very stupid question to ask... but first the background:

Currently running through a SaaS questionnaire with a third party application for Jira Cloud and we received the following response to one of the questions:

Q: Which parties have access to data stored or processed within the cloud service?
A: Customer, vendor, and a third party

We queried why the vendor and a third party have access which came back as the app is stored on GCP and the vendor uses Atlassian API to access issue data without which will limit the functionality of the app.

So my actual question: When you add a third party application to a cloud site, what is actually happening in the background? Sounds like nothing is "installed" on the site and instead it's only opening access to an application which lives on another server? As a said, feels a fundamental/silly question but cannot find any clarification in Atlassian documentation on this.

We're only dipping our toes in the cloud pool as our main instance is data center  so obviously we're very used to installing apps directly into our instance.

Trudy P Claspill

Hello @Ben R 

The answer is, it depends on the app.

With Jira Cloud vendors are limited in what they can add to the site. They are not granted access to install code on the server where Jira is being hosted. They can only interact with the Jira instance via the API.

So, depending on what functionality they are trying to provide, they may not be able to add the necessary components to the Jira environment directly. Instead they may have to host code on a separate system and pull/push data from/to Jira via the REST API.