Security & data
This page applies to all AI Developer apps. For the enterprise summary see AI Developer for the Enterprise.
Isolated runners
- Nothing runs inside Jira. The Jira app sends a job to a regional gateway, which starts a fresh, isolated container for that job.
- The container clones your repository, runs Claude Code or OpenAI Codex, commits and pushes, and reports the result back to Jira.
- The job details are handed over through a short-lived job file, and the result callback to Jira is protected by a one-time token.
- Telemetry and error reporting of the AI tooling are disabled in the runner.
Regions
Jobs are dispatched to a regional gateway. Regions available: EU, Germany and US. Other regions available on request. The region follows the data residency of your Jira site.
Credentials
- Git tokens and AI credentials are stored as secrets in the app's Atlassian Forge storage and are masked in the settings UI.
- They are used only to run your jobs. Use tokens with minimal scopes, restricted to the repositories you need, and set an expiry.
- With AWS Bedrock or Microsoft Foundry your AI usage stays inside your own cloud account.
Access control
| Control | Behavior |
|---|---|
| Branch protection | The AI only pushes to new ai/* branches, never to your base branch. A developer reviews and merges. |
| Jira permissions | In Spec Driven Development every action requires edit permission on the issue. |
| Forge scopes | read:jira-work, write:jira-work (comments), read:jira-user and storage:app. |
| External calls | The apps contact only the AI Developer gateways under *.ai-developer.smart-fusion.tech. |
Support
For help or to report issues, email support@smart-fusion.tech.