Data processing addendum
Cover Page · last updated October 7, 2026
This Cover Page incorporates by reference the Bonterms Data Protection Addendum Version 2.0 (Cover Page Version) (the "DPA", free to use under CC BY 4.0). Together they apply whenever Steadyfield processes personal data for a customer through one of its Atlassian Marketplace apps. Capitalized terms are defined in the DPA.
Key Terms
| Provider | Steadyfield, support@steadyfield.atlassian.net |
|---|---|
| Customer | The customer that subscribes to a Steadyfield app on the Atlassian Marketplace. Its contact details are those in its Atlassian account and Marketplace order. |
| Main Agreement | The Bonterms Standard End User Agreement (Version 1.0) with the app's Provider-Specific Terms, which incorporate this Cover Page. |
| DPA Effective Date | The date the Customer enters into the Main Agreement for a Steadyfield app. |
| Subprocessor List | See Subprocessors below. |
| Designated EU Governing Law | The laws of Ireland |
| Designated EU Member State | Ireland |
The Customer and Steadyfield enter into the DPA when the Customer enters into the Main Agreement; no signature is needed. Email us if you need a countersigned copy.
Processing Details
| Subject matter and nature | Providing the app the Customer subscribes to, as described in its documentation: reading and storing Jira data within the Customer's Atlassian site to run the app's features. |
|---|---|
| Purpose | Only to provide, secure and support the app under the Main Agreement. |
| Data subjects | The Customer's Jira users, such as employees and contractors. |
| Special categories of data | None. The apps aren't designed for them, and the Main Agreement asks customers not to submit sensitive data. |
| Frequency and duration | Continuous while the app is installed. On uninstall, Atlassian deletes the app's Forge storage within 28 days. Values the app wrote into Jira stay until the Customer removes them. |
| Location | All storage and processing happen on Atlassian's Forge platform and in the Customer's Atlassian site, following the site's data residency location. Steadyfield runs no servers of its own and keeps no copies of customer data. App logs are kept by Atlassian and visible to Steadyfield only if a Customer admin allows log access. |
| Provider contact | support@steadyfield.atlassian.net |
Personal data by app
| App | Processing | Personal data |
|---|---|---|
| Sprint Ledger | Stores its five sprint history field values on issues in Jira, and settings and scan status in Forge storage. Reads issues, sprints and the Sprint field's history, whose entries name the account id of the person who made each change. | Atlassian account ids in Sprint field history (read, not stored). |
| Field Defaults | Stores the customer's default-value rules in Forge storage and as UI modifications in Jira. In the Create dialog, reads the fields the rules cover in the user's browser. | Account ids of people chosen in rules and of project leads (stored); the creating user's account id and time zone (browser only); values typed into covered fields (browser only). |
| Issue Type Rules | Stores the customer's rules (group and project role ids) in Forge storage, as UI modifications and as Jira app properties. Checks who may create an issue type. | The creating user's account id and group and role memberships (held for up to a minute in function memory). |
| Bulk Links | Searches issues and creates, changes and deletes issue links as the signed-in user. Stores each run (its search and the links it changed) in Forge storage for 30 days so it can be undone. | The account id of the person who ran each run (stored with the run, 30 days); issue ids and keys of linked issues (stored with the run). |
Security Measures
- The apps run entirely on Atlassian Forge with no outbound network access, no remote servers and Atlassian-hosted storage, under Atlassian's own security program.
- Data is isolated per Atlassian site; the apps act with the permissions Atlassian grants them, and admin features check that the user is a Jira administrator.
- Least-privilege scopes, dependencies checked for known vulnerabilities before each release, and deployment credentials kept as secrets.
- No names, email addresses or issue content in logs.
- Security incidents are reported to Atlassian within 24 hours and to affected customers without undue delay, and in any event within the DPA's 48 hours.
Each app's security page has the details: Sprint Ledger, Field Defaults, Issue Type Rules, Bulk Links.
Subprocessors
| Subprocessor | Function | Location |
|---|---|---|
| Atlassian Pty Ltd and its affiliates | Hosting and running the apps on Atlassian Forge: compute, storage and logs | Atlassian's infrastructure, following the Customer's data residency location |
We notify customers of a new subprocessor at least 30 days in advance by email to their Marketplace contacts or in-product notice to an administrator.