Your data never passes through Oktul's infrastructure
Every Oktul application is built on Atlassian Forge. Atlassian operates the runtime, stores the data and enforces the restrictions you set. No part of Oktul's infrastructure sits between your users and their work.
Atlassian runs the code. We write it
Forge is Atlassian's own application runtime, and every Oktul application is built on it.
- Runtime
- Atlassian Forge
- Data storage
- Your Atlassian site
- Oktul infrastructure
- None
The code runs on Atlassian's compute, and we hold no token of yours
Forge functions run in Atlassian's own environment, isolated per application, under the scopes the application declares at install. We never hold an API token or service account of yours. There is no hosting of ours to assess, and no Oktul outage can affect your apps.
Application data sits in Atlassian's database and stays on your site
What an application stores goes in Forge's database, which Atlassian keeps encrypted and isolated to your site. Data that belongs to a work item stays on the work item. If you change your data residency, the data moves with your site.
The manifest lists every host an application may reach, and a proxy enforces it
A Forge app can reach only the hosts named in its manifest. An Atlassian proxy enforces that list on every outbound request, whatever the application tries. You can read the list before you install, and a host added later needs your administrator's approval again.
Runs on Atlassian
Atlassian grants this badge automatically to every application that sends no data outside the Atlassian ecosystem and uses Atlassian's storage.
Error logs reach us unless you opt out
Atlassian can share logs, analytics and custom metrics from your site with an app's developer, with a switch for each.
Our logs never name a person or their work
Download the logs from your admin settings to see exactly what we receive.
Turn off log sharing in admin.atlassian.com
- Go to admin.atlassian.com and select your organisation.
- Select Apps, then Sites, then the site you are administering.
- Select Connected apps, then the application.
- In the Details tab, turn off Logs access, Analytics access and Custom metrics access.
How log sharing works
When you install a Forge app, Atlassian turns on log sharing by default and the developer gets access to that application's logs for your site. It applies to every Forge app on your site, ours included.
Our logs record errors, and the counts and timings of what an application did. They hold no work item or page content and no user records. Atlassian's logging guidelines (opens in a new tab) tell developers not to log names, email addresses, usernames or user-generated content, and we follow them.
What changes when you switch logs off
Marketplace reporting still shows us your licence. The same page downloads the logs, and the audit log keeps your log sharing history. With logs off, we cannot diagnose a fault from our side and ask you for the log file instead, which takes longer.
Our CSA STAR entry and legal documents are public
Everything we commit to is in these documents, ready for your security review.
CSA STAR Level 1
Oktul is listed in the Cloud Security Alliance STAR Registry at Level 1. We completed the CAIQ Lite questionnaire with all 138 questions, and published it for you or for your security reviewer. Each application's own entry is on its product page.
Read the company assessment (opens in a new tab)ISO/IEC 27001 certification expected by March 2027
Oktul is implementing an information security management system to ISO/IEC 27001 and expects to be certified by March 2027 at the latest.
Atlassian told within one hour, the Inspectorate within 72 hours
We have had no security breach or incident to date. If one occurs, we tell Atlassian within one hour and, where personal data is affected, the Estonian Data Protection Inspectorate within 72 hours, as the GDPR requires.
Report a vulnerability in the Help Center
Raise it in the Help Center (opens in a new tab), or email support@oktul.com. The Help Center is usually faster, because its form asks for what an email can leave out.
A reply within 24 hours, Monday to Friday
The reply comes from the people who wrote the code. Time to a solution is set per priority, following the Atlassian Fortified programme.
| Priority | Time to solution | What it means |
|---|---|---|
| Critical | 7 calendar days | The application is down, or a technical issue is severely blocking the business. |
| Critical security | 7 calendar days | A vulnerability scoring CVSS 9.0 or above. An immediate threat to cloud infrastructure or to data. |
| High security | 14 calendar days | A vulnerability scoring CVSS 7.0 or above. Significant security exposure with no simple workaround. |
| Medium security | 28 calendar days | A vulnerability scoring CVSS 4.0 to 6.9. A moderate security risk. |
| Low security | 56 calendar days | A vulnerability scoring below CVSS 4.0. A minor security issue with low potential for exploitation. |
| Standard support request | No resolution target. We reply within 24 hours, as we do to every request | A question, a configuration problem, a documentation gap or a feature request. Nothing is broken and nothing is exposed. |
What security and procurement teams ask
Do Oktul applications send data outside the Atlassian ecosystem?
Only where a feature has to, such as signing a Confluence page, and then only what that feature needs. Everything else stays in your Atlassian ecosystem, because the applications run on Atlassian Forge, not on infrastructure we operate. The application’s documentation names every party that receives data and what it receives.
Do Oktul applications send data to an AI model?
No. None of our applications runs an AI model, and none sends your data to one outside Atlassian unless an administrator turns that on. Each application’s privacy notice lists every host it may contact. Work Item Selector, Work Item Macro and Regex Field declare none. SignPlus declares Dokobit, its signing provider. Code Studio declares the Git hosts it syncs with, Atlassian’s gateway, and each host a site administrator approves for a script. Code Studio’s five agents are Rovo agents, and Rovo is Atlassian’s AI: it reads your Jira and Confluence data under Atlassian’s terms, not ours. Code Studio’s tools also reach Claude or another MCP assistant, but only after an administrator turns them on, and what that assistant reads goes to its provider under your agreement with them.
How do Oktul applications empower Rovo and other agentic teammates?
They keep the work in Jira and Confluence, where Atlassian’s Teamwork Graph and Rovo look for context. Work Item Selector writes each relationship to a work item property on both work items, which the Teamwork Graph reads. Work Item Macro reads Jira live, so a page never carries a stale copy. SignPlus attaches the signed document to the page it was signed from. Code Studio sends each script to the Teamwork Graph through a connector, with its own access rules, once an organisation admin connects the app. Rovo shows a script only to people who may open it in Code Studio.
How did you check what Rovo and the Teamwork Graph do before building for them?
From Atlassian’s own Forge packages and developer documentation, read and dated, then held by tests in our code. Five findings decide what we build. A Forge app either publishes into the Teamwork Graph through a connector or queries it, never both. Atlassian accepts a connector only from an app installed into Jira. What a connector sends is visible to everyone on the site unless the app sends permissions of its own, so a connector we build restates the application’s own access and leaves out anything whose access it cannot state. A Rovo agent inside an app reads only through that app’s actions, as the person talking to it. An AI assistant outside Atlassian, such as Claude, reaches an app only through Atlassian’s MCP (Model Context Protocol) endpoint, after an administrator turns the app’s tools on. In the applications on this site, Work Item Selector writes each relationship to work item properties, which the Teamwork Graph reads. Work Item Macro reads Jira live, as the reader. SignPlus keeps signed documents on the page. Regex Field checks values in Jira. Code Studio’s Rovo agents read as the person talking to them and write drafts only, and its connector publishes scripts to the Teamwork Graph with Code Studio’s own permissions. None of them runs an AI model.
Who maintains the applications, and what happens if they stop?
Solution architects named on the company page, holding twenty-three Atlassian certifications and accreditations together. Oktul OÜ is registered in Estonia under registry code 17589681. The applications run exclusively in your Atlassian ecosystem. Atlassian runs the code on its own platform, and your configuration and data stay in your ecosystem whatever happens to us.
How fast do you respond when something breaks?
An initial response within 24 hours, Monday to Friday, on a Help Center request. Raise one in the Help Center, or email support@oktul.com. It takes incidents, bugs, questions, demo and feature requests, and requests for an application we have not built yet.
Why trust Oktul with a bank’s or a ministry’s Atlassian site?
Because we have spent years inside financial, public and private sector Atlassian ecosystems, and our applications solve the problems we met there. They run on Forge, so your ecosystem depends on no part of our infrastructure.
Is Oktul an Atlassian partner?
Yes. Oktul is an Atlassian Marketplace Partner, with its own partner page on the Atlassian Marketplace.
What does it cost to evaluate one?
Nothing. Every paid Oktul application has a 30-day free trial and is free for up to 10 users. Pricing and billing run through the official Atlassian Marketplace, so the charge lands on your existing Atlassian invoice and there is no new supplier to onboard.
Bring the context together
Start with an app from the Atlassian Marketplace, or tell us which app or Rovo agent is missing.
Or write to support@oktul.com
