Security and data

AssertThat Autonomous Test Management is built on Atlassian Forge and runs on Atlassian’s infrastructure.

Where your data lives

• Test data (test cases, plans, executions, results, history) is stored in Forge SQL, Atlassian’s hosted database for Forge apps.
• Settings and AI usage are stored in Forge storage.
• Attachments are stored in Forge’s hosted object storage.

Data is stored by Atlassian alongside your Jira site, not on AssertThat servers. The app makes no calls to external services: it has no outbound network access, so it is eligible for Atlassian’s Runs on Atlassian programme.

AI processing

All AI features use Atlassian’s hosted large language models through Forge. Prompts and results stay within Atlassian; there are no third-party AI providers and no API keys to manage. AI use is limited by a monthly allowance.

Access control

• Access follows Jira project permissions, mapped per project in Project settings. The same checks apply in the app, the issue panel, the AI assistant, Rovo, MCP and the REST API.
• The AI assistant, Rovo agent and MCP act as the signed-in user, never with more rights than that user has.
• Only people can approve test cases in the review workflow.

API keys

• CI import keys and personal API keys are shown once at creation. Only a hash is stored.
• Personal keys can expire. Owners can revoke their own keys and Jira administrators can revoke any key.
• Requests are logged with the key, project and route or format, never with report contents or the key itself.

Retention

Data	Kept for
Audit log	730 days by default, configurable
API and CI import request logs	30 days
AI chats	Deleted after 90 days without use
Archived items	Until restored or permanently deleted

Responsible deletion

Deleting an item archives it first, so it can be restored. Permanent deletion needs the Manage settings and delete permission and a typed confirmation.

For AssertThat’s company-wide security policies, certifications and trust documents, see the Trust Center.