1. Purpose and Scope

This Security Policy describes the measures and principles applied to protect systems, data, and integrations related to JIRA2SAP™, including the use of Jira templates for SAP integration.

The policy applies to:

1. The JIRA2SAP connector
2. Data exchanged between Jira and SAP systems
3. Jira templates provided for Jira Data Center and Jira Cloud

This policy focuses on technical and organizational security controls and is separate from the Privacy Policy, which addresses personal data processing.

2. Security Principles

JIRA2SAP is designed according to the following core principles:

1. Least privilege: Access is limited to what is strictly necessary
2. Separation of concerns: Jira templates structure data; integration logic is handled externally
3. Secure communication: Data is transferred using encrypted channels
4. Customer isolation: No cross-customer data access
5. Transparency: Clear documentation of responsibilities and data flows

3. Access Control and Authentication

1. Access to JIRA2SAP components is restricted to authorized systems and users only.
2. Authentication mechanisms are used to protect all communication channels.
3. Credentials and tokens are handled securely and are never exposed in Jira templates.
4. Administrative access is limited and monitored.

4. Data Transmission Security

1. All data transfers between Jira, JIRA2SAP, and SAP systems use encrypted connections (e.g. HTTPS/TLS).
2. No unencrypted communication channels are supported.
3. Jira templates themselves do not initiate direct connections to SAP systems.

5. Data Processing and Storage

1. JIRA2SAP processes only the data required to perform the integration.
2. Jira templates do not store SAP credentials or connection details.
3. Any temporary data handling is limited to what is technically necessary to complete synchronization.
4. Data retention follows customer agreements and system requirements.

6. Customer Separation

1. Each customer’s integration setup is logically separated.
2. No customer data is shared across environments.
3. Test and production environments are separated where applicable.

7. Logging and Incident Handling

1. Integration activities and errors are logged for troubleshooting and audit purposes.
2. Logs are used for operational security and incident analysis only.
3. In case of a security incident, appropriate measures are taken to assess, contain, and resolve the issue.

8. Jira Templates – Security Considerations

Jira templates provided by ALPEIN Software SWISS AG are supporting configuration elements, not standalone integration components. Their security characteristics depend on the Jira deployment model.

8.1 Jira Data Center Templates

For Jira Data Center, templates are provided as installable files (e.g. .jar):

1. Templates are installed within the customer’s Jira Data Center environment.
2. They define project structures, custom fields, and workflows only.
3. Templates do not contain SAP credentials or sensitive connection data.
4. Templates do not directly access SAP systems.
5. All data transfer to SAP is handled by the JIRA2SAP connector, not by the template itself.
6. Security of the Jira Data Center environment remains the responsibility of the customer.

8.2 Jira Cloud Templates

For Jira Cloud, templates are provided as configuration instructions, not software components:

1. No files or applications are installed in Jira Cloud.
2. Templates consist of documented steps to create Spaces, fields, and automation rules.
3. Jira Cloud templates do not execute code.
4. Jira Cloud templates do not store credentials or secrets.
5. Data transfer is initiated via Jira Cloud automation and handled by the external JIRA2SAP connector.
6. This approach aligns with Jira Cloud security and compliance requirements.

9. Responsibilities

Customers are responsible for:

1. Securing their Jira and SAP environments
2. Managing user access and permissions
3. Configuring templates according to internal policies

ALPEIN Software SWISS AG is responsible for:

1. Secure design of JIRA2SAP
2. Providing secure integration mechanisms
3. Maintaining and updating documentation

10. Policy Maintenance

This Security Policy is reviewed periodically and updated as necessary to reflect:

1. Product changes
2. Security best practices
3. Customer and regulatory requirements

11. Summary

JIRA2SAP follows a security-by-design approach:

1. Jira templates are non-invasive and non-sensitive
2. Integration logic is centralized and controlled
3. Jira Cloud and Data Center differences are clearly respected
4. Security responsibilities are transparent and well-defined