Trust center

Encryption at Rest

Last updated:

Where Hooq stores data

Hooq stores data only in Atlassian Forge hosted storage (key-value storage), which Atlassian provisions per site installation, and in Jira itself. Hooq has no external database, file store or backup of its own. What Hooq keeps in Forge storage is configuration and operating state: connector and pairing configuration, project and field mappings, sync settings, links between paired work items, queue and idempotency records, a short-lived error log (see Data Logging and Retention), and the cryptographic material needed for pairing (stored in Forge storage).

What the platform provides

Atlassian’s Forge documentation (Storage overview) states that Forge hosted storage capabilities “encrypt and store data on disk”, “automatically scope data per installation to ensure tenant safety”, and “keep data in the location of the host Atlassian app, so your app inherits data residency without extra configuration”. Hooq relies on these platform controls for encryption at rest. The encryption algorithm and key management are operated by Atlassian and are not specified by Hooq.

Customer data held by Hooq at rest therefore is:

  1. Forge hosted storage, encrypted on disk by Atlassian as above.
  2. Jira, which is Atlassian’s product and covered by Atlassian’s own controls.

Hooq stores no end-user data outside these two places.

App logs

  • Hooq’s application log lines are written to the Atlassian Forge logging service, which Atlassian operates. Hooq keeps no separate log store.
  • The in-app error log shown on Hooq’s Troubleshooting tab is held in Forge hosted storage and is therefore covered by the encryption above.

Transport and message security (supporting controls)

  • Traffic between Hooq and Atlassian, and between paired sites, uses HTTPS. Atlassian states it uses TLS to encrypt all traffic on the Forge platform, including HSTS (Forge shared responsibility model, network security).
  • Messages between paired Hooq sites are authenticated with HMAC signatures over the message, a timestamp and a one-time nonce. Messages outside a five-minute window or with a repeated nonce are rejected.
  • Pairing uses an RSA key pair generated per installation; the shared secret is delivered encrypted to the partner’s public key.

Key handling

Keys and shared secrets are stored in Forge storage. They are not displayed in the Hooq user interface.

Hooq overview · Trust center · Questions: [email protected]