Trust center
Subprocessors and Third-Party Integrations
Last updated:
Summary
Hooq runs entirely on Atlassian Forge and sends Jira data only to (1) the Jira Cloud APIs of the site it is installed on and (2) the Hooq endpoint of a partner Jira site that the administrators of both sites paired. Hooq operates no servers and uses no third-party service in its runtime. Hooq’s only subprocessor is Atlassian (Forge hosting, storage and logs, and web triggers between the customer’s own paired sites). No other subprocessor receives customer data.
Runtime
| Party | Role | What it receives | Location |
|---|---|---|---|
| Atlassian (Forge platform and Jira Cloud) | Infrastructure and product provider: runs Hooq’s functions, queues, storage and logging; hosts Jira | Everything Hooq processes | In the location of the customer’s Jira site (data residency applies to Forge hosted storage) |
The partner Jira site chosen by the administrators (reached through its Hooq web trigger on *.hello.atlassian-dev.net, the only domain Hooq calls) | Destination of synced content, selected by the customer | Only the fields the administrators configured to sync | The partner site’s own location. If the two sites are in different locations, synced content moves between them by design |
Declared outbound (egress) domains
Hooq’s only outbound destination is the Hooq web trigger of the partner site, which is a Forge-hosted endpoint under *.hello.atlassian-dev.net. That is the one domain Hooq calls.
The manifest currently declares five domains for backend calls, all of them Atlassian domains and none a full wildcard: https://*.forgeblocks.com, https://*.hello.atlassian-dev.net, https://*.hello.atlassian.net, https://*.atlassian.net, https://*.services.atlassian.com. All other calls use Forge’s managed Jira clients and need no declared domain. Hooq makes a single kind of outbound call: the signed POST to the partner site’s Hooq web trigger. Hooq makes no call to any non-Atlassian host.
Software dependencies
Hooq’s runtime dependencies are Atlassian Forge packages and a small number of libraries bundled into the app. None is a hosted service and none receives data from Hooq over a network.
Not used
No analytics, telemetry, advertising, error-reporting service, CDN, email service, or external database. Hooq does not sell or share customer data.
Contact
Questions about this document: see the security contact in Security and Incident Response.