nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

ScriptRunner access to site data

warrencai

As part of a privacy and security review, I'm trying to understand what data gets transferred and stored by Adapatavist when we use the addon for Jira Cloud.

Is there any documentation to what data ScriptRunner collects and what Adapativist stores?

When I try to interact with their support, they point to their general documentation for data storage and privacy policy, not for ScriptRunner itself.

I would like to create some controls (even if it's just process controls where we as admins make sure we don't put certain data into ScriptRunner or ask ScriptRunner to log certain data). But I'm not able to find any documentation on the boundaries of what ScriptRunner will and will not access/store.

Does any admins have any experience with this?

Accepted answers

All comments

Trudy P Claspill

Hello @warrencai

Welcome to the Atlassian community.

I see that you said you've been directed to their general documentation. Does that include the information referenced here, and the documents referenced in that page?

https://marketplace.atlassian.com/apps/6820/scriptrunner-for-jira?hosting=cloud&tab=privacy-and-security

warrencai

Hi Trudy,

Yes. Specifically, I'm was trying to understand the line "Content posted, received or shared in the app by end-users". I asked their support what constitutes in the app but could not get a clear answer.

Thank you,

Warren

Nicolas Grossi

@warrencai You might also check here: https://docs.adaptavist.com/sr4js/latest and on the provider support site.

warrencai

HI @Nicolas Grossi

Unfortunately, the ScriptRunner cloud documentation does not go into detail on what data the addon accesses and stores and when.

Thank you,

Warren

Trudy P Claspill

Additionally that link leads to the documentation for ScriptRunner for Jira Data Center, not Jira Cloud

Trudy P Claspill

Hi Warren,

I'm reaching out to contacts at Adaptavist to see if they have any more specific reference materials publicly available.

warrencai

Thank you so much!

Romy Greenfield

Due to the nature of ScriptRunner allowing users to create their own scripts and queries, it is not possible to give an exhaustive list of what information could be accessed, processed or stored by ScriptRunner, as this can be affected by unique inputs by the end user.

ScriptRunner processes and stores webhook event information sent by Atlassian, customer scripts and enhanced search queries. It may store error responses from Atlassian REST APIs in order to show customers how to correct any queries. ScriptRunner stores the base url of the customer instance but uses unique IDs when referencing end users, filters and issues where possible. However, if an end user decides to log PII in a script or writes this in an Enhanced Search query it will appear in logs and potentially be stored long term.

ScriptRunner only stores audit logs indefinitely for customers to view in the app - it stores all other logs for up to 4 weeks. The logs are only used to help debug issues with the app as and when necessary. Other than the customer accessible audit logs, the logs can only be accessed by the engineers directly working on and supporting the app.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

scriptrunner

jira

cloud

adaptavist

addon-com.onresolve.jira.groovy.groovyrunner

jira-cloud