1. Purpose and Scope

This Security Policy describes the measures and principles applied to protect systems, data, and integrations related to JIRA2SAP™, including the use of Jira templates for SAP integration and AI-powered JIRA2SAP solutions developed and operated by ALPEIN Software SWISS AG.

The policy applies to:

1. The JIRA2SAP connector
2. Data exchanged between Jira and SAP systems
3. Jira templates provided for Jira Data Center and Jira Cloud
4. JIRA2SAP AI-powered components, including the AI agent, Retrieval-Augmented Generation (RAG) functionality and associated enterprise knowledge processing
5. Selected SAP data and enterprise documents processed by the JIRA2SAP AI solution

This policy focuses on technical and organizational security controls and is separate from the Privacy Policy, which addresses personal data processing.

2. Security Principles

JIRA2SAP is designed according to the following core principles:

1. Least privilege: Access is limited to what is strictly necessary
2. Separation of concerns: Jira templates structure data; integration logic is handled externally
3. Secure communication: Data is transferred using encrypted channels
4. Customer isolation: No cross-customer data access
5. Transparency: Clear documentation of responsibilities and data flows
6. Data minimization: Only information required for the relevant integration or AI use case is processed
7. Human control: AI-generated recommendations support decision-making but do not independently authorize critical SAP actions.
8. Controlled knowledge access: Only approved information sources are made available to the AI knowledge layer.

3. Access Control and Authentication

1. Access to JIRA2SAP components is restricted to authorized systems and users only.
2. Authentication mechanisms are used to protect all communication channels.
3. Credentials and tokens are handled securely and are never exposed in Jira templates.
4. Administrative access is limited and monitored.
5. Access to the JIRA2SAP AI infrastructure, knowledge repositories and related services operated by ALPEIN Software SWISS AG is restricted to authorized systems and personnel according to operational requirements.
6. Customer-specific AI data and knowledge sources are accessible only within the corresponding authorized integration environment.

4. Data Transmission Security

1. All data transfers between Jira, JIRA2SAP, and SAP systems use encrypted connections (e.g. HTTPS/TLS).
2. No unencrypted communication channels are supported.
3. Jira templates themselves do not initiate direct connections to SAP systems.
4. Where JIRA2SAP AI functionality is used, communication between SAP, Jira, the JIRA2SAP connector, the AI components and the JIRA2SAP knowledge layer is also performed through secured communication channels.
5. The AI functionality is hosted and operated as part of the JIRA2SAP service infrastructure managed by ALPEIN Software SWISS AG.

5. Data Processing and Storage

1. JIRA2SAP processes only the data required to perform the integration.
2. Jira templates do not store SAP credentials or connection details.
3. Any temporary data handling is limited to what is technically necessary to complete synchronization.
4. Data retention follows customer agreements and system requirements.
5. For AI-powered JIRA2SAP solutions, selected SAP information and approved enterprise documents may be transferred to and processed within the JIRA2SAP AI infrastructure operated by ALPEIN Software SWISS AG.

This information may be prepared and indexed in a customer-specific knowledge base for Retrieval-Augmented Generation (RAG).

• Depending on the agreed use case, this information may include:
• Historical SAP service cases
• Completed notifications or service activities
• Equipment and machine information
• Failure and resolution information
• Service reports
• Technical manuals
• Schematics
• Service bulletins
• PDFs, attachments and other approved enterprise documents
• Relevant SAP metadata required to preserve business context

Only data and documents defined as relevant to the agreed AI use case are intended to be included in the AI knowledge layer.

Current operational SAP information does not necessarily need to be permanently stored in the knowledge base. Where appropriate, current information can be retrieved through JIRA2SAP when required for a specific service case.

Where delta synchronization is configured, relevant changes in SAP can trigger selective updates so that only affected information is reprocessed instead of repeatedly processing the complete knowledge base.

6. AI Processing and Knowledge Security

The AI functionality used in JIRA2SAP AI-powered products is a custom development of ALPEIN Software SWISS AG and is operated within the JIRA2SAP service environment.

The AI layer combines approved enterprise knowledge with business context obtained through JIRA2SAP in order to provide recommendations, information retrieval and decision support within Jira.

6.1 Approved Knowledge Sources

Only information sources approved for the respective customer implementation are intended to be included in the AI knowledge base.

These may include selected:

• SAP CS information
• Historical service information
• Technical documents
• Manuals
• Service reports
• Other enterprise documentation

The scope of data made available to the AI solution is defined as part of the customer-specific implementation.

6.2 Retrieval-Augmented Generation (RAG)

JIRA2SAP may use Retrieval-Augmented Generation to identify information relevant to a specific request and provide this information as context to the AI agent.

The purpose of RAG is to ground AI responses in approved enterprise information rather than relying solely on general model knowledge.

Where supported by the configured solution, relevant sources or similar historical cases can be made available together with AI-generated recommendations to improve transparency and traceability.

6.3 Human-in-the-Loop Controls

AI-generated diagnoses, recommendations, troubleshooting steps and proposed actions are intended as decision support.

Critical business decisions remain under human control.

Where SAP write-back actions are configured:

• The required review and approval process can be performed in Jira
• Only predefined and permitted actions are transferred through JIRA2SAP
• The AI agent does not independently receive unrestricted authority to modify SAP business objects

6.4 Knowledge Updates

Relevant SAP objects can be monitored for changes through the JIRA2SAP integration. Where configured, new, changed or completed information can trigger a selective knowledge update.

This allows the AI knowledge layer to remain current while limiting unnecessary processing.

7. Customer Separation

1. Each customer’s integration setup is logically separated.
2. No customer data is shared across environments.
3. Test and production environments are separated where applicable.
4. AI-related customer data, knowledge repositories and integration configurations are logically separated between customers.
5. Customer knowledge is used only within the corresponding authorized JIRA2SAP customer environment and is not made available to other customers.

8. Logging and Incident Handling

1. Integration activities and errors are logged for troubleshooting and audit purposes.
2. Logs are used for operational security and incident analysis only.
3. In case of a security incident, appropriate measures are taken to assess, contain, and resolve the issue.
4. Where applicable, AI-related integration activities such as knowledge updates, retrieval processes and approved SAP write-back actions may also be logged for troubleshooting, operational security and traceability.
5. Logging is limited to information necessary for operating, monitoring and securing the relevant service.

9. Jira Templates – Security Considerations

Jira templates provided by ALPEIN Software SWISS AG are supporting configuration elements, not standalone integration components. Their security characteristics depend on the Jira deployment model.

9.1 Jira Data Center Templates

For Jira Data Center, templates are provided as installable files (e.g. .jar):

1. Templates are installed within the customer’s Jira Data Center environment.
2. They define project structures, custom fields, and workflows only.
3. Templates do not contain SAP credentials or sensitive connection data.
4. Templates do not directly access SAP systems.
5. All data transfer to SAP is handled by the JIRA2SAP connector, not by the template itself.
6. Security of the Jira Data Center environment remains the responsibility of the customer.

9.2 Jira Cloud Templates

For Jira Cloud, templates are provided as configuration instructions, not software components:

1. No files or applications are installed in Jira Cloud.
2. Templates consist of documented steps to create Spaces, fields, and automation rules.
3. Jira Cloud templates do not execute code.
4. Jira Cloud templates do not store credentials or secrets.
5. Data transfer is initiated via Jira Cloud automation and handled by the external JIRA2SAP connector.
6. This approach aligns with Jira Cloud security and compliance requirements.

For AI-powered JIRA2SAP solutions, Jira Service Management may act as the user-facing workspace for service requests, SAP context, AI recommendations, retrieved knowledge, source references, review processes and approved actions.

The Jira template or Jira configuration does not contain the AI model, AI knowledge base or SAP credentials. AI processing and SAP integration are performed by the JIRA2SAP infrastructure operated by ALPEIN Software SWISS AG.

10. Responsibilities

Customers are responsible for:

1. Securing their Jira and SAP environments
2. Managing user access and permissions
3. Configuring templates according to internal policies
4. Defining which SAP data and enterprise documents may be made available to the JIRA2SAP AI solution
5. Ensuring that selected information may be processed for the agreed AI use case in accordance with internal policies and applicable legal or contractual requirements
6. Defining the users and roles authorized to access AI-assisted information and recommendations
7. Defining appropriate review and approval processes for business-critical actions

ALPEIN Software SWISS AG is responsible for:

1. Secure design of JIRA2SAP
2. Providing secure integration mechanisms
3. Maintaining and updating documentation
4. Development and operation of the JIRA2SAP AI components
   Protecting the JIRA2SAP-hosted AI infrastructure and associated customer-specific knowledge environments
5. Maintaining logical separation between customer environments
6. Implementing the agreed data flows between SAP, Jira and the AI knowledge layer
7. Restricting AI-supported SAP actions to the functionality and authorization defined for the respective implementation

11. AI Limitations and Responsible Use

AI-generated content may contain incomplete, inaccurate or unsuitable recommendations. AI output must therefore be treated as decision support rather than as an automatically authoritative business decision.

The use of RAG and enterprise context is intended to improve the relevance and traceability of AI-generated responses but cannot guarantee that every generated recommendation is correct.

Human review remains particularly important for actions affecting customers, equipment, business-critical processes or SAP data.

12. Policy Maintenance

This Security Policy is reviewed periodically and updated as necessary to reflect:

1. Product changes
2. Security best practices
3. Customer and regulatory requirements
4. Changes to JIRA2SAP AI functionality
5. Changes to the architecture or processing of enterprise knowledge within JIRA2SAP

13. Summary

JIRA2SAP follows a security-by-design approach:

1. Jira templates are non-invasive and non-sensitive
2. Integration logic is centralized and controlled
3. Jira Cloud and Data Center differences are clearly respected
4. Security responsibilities are transparent and well-defined
5. JIRA2SAP AI functionality is developed and operated by ALPEIN Software SWISS AG
6. Customer-specific AI knowledge and configurations are logically separated
7. Only information defined for the relevant AI use case is intended to be processed
8. SAP remains the system of record for relevant business and service objects
9. AI assists with knowledge retrieval and recommendations, while critical decisions remain under human control
10. Defined SAP actions can be executed through JIRA2SAP only within the configured integration and authorization process

For AI-powered JIRA2SAP solutions, the guiding principle is: AI finds and contextualizes knowledge, people decide, and JIRA2SAP connects the approved action to SAP.