Data security and privacy statement - Alpha Serve

Owned by Olga Gaivanenko (Unlicensed)
Mar 17, 2020
8 min read

Data security and privacy statement

Overview

Alpha Serve offers your team a full set of tools that help create better project solutions, provide an extra level of security and deliver intelligent integrations for your business. The aim of this documentation is to cover all of the relevant information about the Data Security & Privacy Statement of Alpha Serve to help our customers see clearly what we do and really don't do with their data.

Introduction

Protecting your data and your privacy is our highest priority and is very important for us. Alpha Serve adheres to a strict policy for ensuring the security and privacy of your data, in particular, your personal identifiable information (such as full name, address, email address, and/or other identifiable information, collectively such personally identifiable information "Personal Data").

Alpha Serve provides hosted services ("Cloud Apps") for Atlassian Cloud Products. The Apps are delivered through the Atlassian Connect App framework ("Atlassian Connect"). Cloud Apps can be identified by the "Cloud" category in the corresponding Atlassian Marketplace listing.

Alpha Serve also provides downloadable products ("Server Apps") for Atlassian Server Products, which are installed on the client's IT-systems. Server Apps can be identified by the "Server" category in the corresponding Atlassian Marketplace listing.

This Data Security and Privacy Statement will provide you with an overview of the collection and processing of your data for both Cloud and Server Apps.

In the following, all data created by an Atlassian Cloud or Server Product end-user and stored within the Atlassian Product are defined as "Customer Data".

Data security and privacy of our apps

We support the latest technical and organizational measures to ensure data security, in particular, to protect your Personal Data. These measures are updated on a regular basis to stay up to date. We would like to draw your attention to the fact that security gaps  are possible when transmitting data on the Internet, and it is impossible to ensure complete protection of data from unauthorized or malicious access by third parties. If you are interested in our data protection concept, please contact us.

We draw your attention to the fact that we do not collect, store or process any personal/confidential information in applications suitable for Atlassian server products, nor do we collect, store or process any analytical or tracking data, but nor do we place cookies or tracking beacons in any applications suitable for Atlassian server products.

Some of our applications depend on the use of personal data, such as usernames and email addresses. All this information is used by the application for internal functional purposes only and, if at all used, is stored in the local database of your Atlassian server product.

CLOUD APPS

DATA STORAGE

Unless otherwise stated below our Cloud Apps do not store Customer Data locally, but store Customer Data in the corresponding Atlassian Cloud Product. The Atlassian Cloud Product Security Statement can be found here.

Exceptions applying to all Cloud Apps:

  • Account Data: Our Cloud Apps store data provided and generated by Atlassian, that are required for license validation, contract administration, and communication with the customer instance. This includes, for example, AddOnKey, ProductType, ClientKey, BaseUrl, ServiceEntitlementNumber, SharedSecret, OauthClientId. Unless explicitly and differently specified in the Addon documentation, we do not store personal information (e.g. name, email address).

  • Session Data: Our Cloud Apps store data resulting from the customer's use of the service and distinguished from Customer Uploaded Data. This includes, for example, the use of statistics of service functions such as the total number of exports per day. This data is anonymized. Therefore, we cannot identify the end user this data relates to. It is exclusively used in order to improve our service. It does not contain any Customer Uploaded Data or Operation Data.

  • Support Data: Our Cloud Apps may offer a problem report functionality which can be triggered in the respective Apps. If a Cloud App offers such functionality, it allows you to automatically report the error to our support team. This functionality will collect relevant support data (e.g. Account Data, Operation Data, Customer Uploaded Data) from our systems and will create a support ticket in our support system on behalf of your users' email address. This data will be stored in the same data location that executed the operation but also downloaded to our own IT-system by a member of our support team. The data is usually saved in our hosts (see below section "End of Subscription"). Please pay special attention that data transfer on the internet can have security gaps and it is not possible to provide the complete protection of data against unauthorized or malicious access of third parties.

  • Real-time Error Tracking Data: Our Cloud Apps track errors of our Cloud Apps' resources executed in the end-users' browsers in real-time. This includes, for example, AddOnKey, ClientKey, BaseUrl, anonymized TrackingID, error messages and information about the environment such as browser type, browser version, and operating system. It is exclusively used in order to improve our service.

  • Product Analytics Data: Our Cloud Apps track user behavior to allow better product decisions based on these insights. This includes, for example, the use of service features such as how often certain features are used and how they are used. This data is anonymized. Therefore, we cannot identify the end user this data relates to. It is exclusively used in order to improve our service.

DATA LOCATION

Alpha Serve uses an Atlassian recommended cloud platform called Amazon for hosting Cloud plugins to comply with all local laws. Amazon's physical infrastructure is hosted and managed within Amazon’s secure data centers and utilizes the Amazon Web Service (AWS) technology. 

Status information about the Amazon cloud platform can be found here: https://status.aws.amazon.com/.

Amazon has published security statements that can be found at the following link:

  •  

https://aws.amazon.com/security/

For check of add-ons licenses, we need to store instance and license information. These are stored on Amazon servers in Oregon, USA.

Our hosting region is United States.

Backups

This section explains our backup and recovery policy for customer data.

  • Our backup data is securely stored, unauthorized access to backup data is not possible.

  • We backup at least once a day, and we keep the backups.

  • Please read the documentation of the product for further details

Billing Data Storage Terms

We may store your billing information (company name, tax codes, bank details, country, contacts of the involved Atlassian partner) to fulfill the requirements of the local tax legislation. We are not able to influence this data storage.

Application and infrastructure security

This section explains  security measures we've taken in our application and infrastructure.

  • Alpha Serve support team accesses addon data only for the purposes of application health monitoring and performing system or application maintenance, and upon customer request for support purposes.

  • Customers are responsible for maintaining the security of their own Confluence and JIRA Cloud login information.

  • Communication between the Cloud products and the AddOn server is done using web requests. All web requests are encrypted, digitally signed, authenticated and authorized.

  • AddOn server is only accessible through secure protocols (e.g. https).

  • Please read the documentation of the product for further details.

Customers of Our Apps

By purchasing a commercial or academic license, our customers accept the following:

  • Alpha Serve will receive personal information of the technical person from Atlassian

  • Alpha Serve will retain all personal information that is shared by Atlassian with Alpha Serve (Atlassian's policy on sharing personal information)

  • Alpha Serve will retain personal information during the active maintenance period and after the expiration of the last maintenance period.

  • Alpha Serve may send emails containing product news, tips, best practices, webinar or training details, event-related information.To comply with GDPR regulations, customers can request the removal, rectification or review of their own personal information stored in the support system by sending an email to support@alpha-serve.com or by clicking the unsubscribe link in the emails received.

ACCESS TO CUSTOMER DATA

Only authorized Alpha Serve employees and subcontractors from our support and development teams have access to Customer Data. Such subcontractors are contractually bound to the same data security and privacy standards that apply to us.

SUBCONTRACTORS

Our subcontractors are:

  • Amazon (Amazon.com, Inc.), is an American multinational technology company based in Seattle, Washington. Our Cloud Apps are hosted on Amazon Platform in Oregon, USA. The Amazon privacy statement can be found here.

  • Sentry (Sentry is a registered trademark of Functional Software, Inc.), San Francisco, USA: We use Sentry for real-time error tracking of our Cloud Apps' resources executed in the end-users' browsers to reproduce and fix crashes. The Sentry privacy statement can be found here.

END OF SUBSCRIPTION

If a customer unsubscribes from our Cloud App we mark stored Customer Data for deletion. However, the customer can contact us to ask for immediate manual deletion.

SERVER APPS

DATA STORAGE

Unless otherwise stated below our Server Apps do not store Customer Data locally, but store Customer Data in the corresponding Atlassian Server Product.

Exceptions applying to all Server Apps:

  • Support Data: Our Server Apps may offer a problem report functionality which can be triggered in the respective Apps. If a Server App offers such functionality, it allows you to automatically report the error to our support team. This functionality will collect relevant support data ("Support ZIP") from the customers' system and will create a support ticket in our support system on behalf of your users' email address. This data will be stored in the support system, but also downloaded to our own IT-system by a member of our support team. The same applies to all data manually sent by the customer reporting an error to our support team.

  • Real-time Error Tracking Data: Our Server Apps track errors of our Server Apps' resources executed in the end-users' browsers in real-time. This includes, for example, AddOnKey, ClientKey, BaseUrl, anonymized TrackingID, error messages and information about the environment such as browser type, browser version, and operating system. It is exclusively used in order to improve our service.

  • Product Analytics Data: Our Server Apps track user behavior to allow better product decisions based on these insights. This includes, for example, the usage of service features such as how often certain features are used and how they are used. This data is anonymized. Therefore, we cannot identify the end user this data relates to. It is exclusively used in order to improve our service.

  • For several apps we use the option to include YouTube videos to the marketplace product pages, allowed by Atlassian. All the videos used on the mentioned pages are stored on www.YouTube.com. In general, this means that some of your user data can be transmitted when you are playing these videos. We are not able to influence or prevent this data transfer. If you don’t want this data transfer, avoid playing the videos. For more information about it, please look at the Atlassian Marketplace Terms of Use and the Atlassian Privacy Policy.

  • We use the option of Google Analytics integration to our Marketplace product pages, allowed by Atlassian. Any information collected by Atlassian or third party partners on the Atlassian Marketplace website is governed by the Atlassian Privacy Policy. Please, note that all such information is anonymized, no personal data can be received or identified. We may use this information to analyze user experience for continuous product improvement.

DATA LOCATION

Data location used by subcontractors.

ACCESS TO CUSTOMER DATA

Only authorized Alpha Serve employees and subcontractors from our support and development teams have access to Customer Data. Such subcontractors are contractually bound to the same data security and privacy standards that apply to us.

SUBCONTRACTORS

Our subcontractors are:

  • Amazon (Amazon.com, Inc.), is an American multinational technology company based in Seattle, Washington. Our Cloud Apps are hosted on Amazon Platform in Oregon, USA. The Amazon privacy statement can be found here.

  • Sentry (Sentry is a registered trademark of Functional Software, Inc.), San Francisco, USA: We use Sentry for real-time error tracking of our Cloud Apps' resources executed in the end-users' browsers to reproduce and fix crashes. The Sentry privacy statement can be found here.