Recoup — Security Information

This document describes the security posture of Recoup, the Atlassian Marketplace app. It is intended for security reviewers at customer organisations evaluating Recoup for installation.

Platform

Recoup is built entirely on Atlassian Forge, Atlassian's hosted application platform. Recoup operates no third-party servers and runs no code outside Atlassian's network for any feature except the optional AI features (which call Anthropic directly from Forge).

What this means in practice

Every function call executes in Atlassian's sandboxed Node 24 runtime
Every storage write goes to Forge Key Value Store (encrypted at rest, AES-256, Atlassian-managed)
Every outbound network call is whitelisted in the Forge manifest and proxied through Atlassian
The app cannot run code on your servers or your users' machines

Permissions

Recoup requests the following Atlassian permission scopes:

Scope	Reason
`read:jira-user`	Enumerate Jira users for the cross-product user list
`read:jira-work`	Read issue activity (assignee, reporter, updated) for last-active timestamps. Never reads issue contents.
`read:group:jira`	Read group memberships for future bloat analysis (planned v1.1)
`read:confluence-user`	Cross-reference Confluence user list
`read:confluence-groups`	Same, group level
`read:servicedesk-request`	Read JSM agent activity for last-active timestamps
`manage:servicedesk-customer`	Required by Atlassian for certain JSM user operations
`storage:app`	Forge KVS — store users, recommendations, settings, audit log

Recoup additionally requests outbound network access to:

api.atlassian.com — Atlassian Admin API (when you supply an org-admin API key)
api.anthropic.com — Anthropic Claude (only when AI features are enabled and an Anthropic API key is configured)

Authentication

Recoup uses two authentication patterns, both standard:

Forge `asApp()` (default)

Recoup invokes Atlassian APIs as the installed app, using Atlassian's internal token mint. Each request is authenticated by Atlassian's platform layer; Recoup never sees a raw user token.

Customer-supplied Atlassian admin API key (optional)

For org-level data (cross-product last_active, user lifecycle), the org-admin API key endpoints require a Bearer token issued by your org admin at admin.atlassian.com. You enter this key in Recoup's Settings. It is stored encrypted in Forge KVS via kvs.setSecret() and is never logged or returned by any resolver to the frontend.

Secret handling

Atlassian admin API key: stored via @forge/kvs setSecret(). Atlassian encrypts secrets with a managed key tied to your Cloud site. Recoup retrieves the secret only inside backend resolvers, never sends it to the frontend, and never logs it.
Anthropic API key: same as above.
No third-party secret manager is used. There is no AWS Secrets Manager, no GCP KMS, no Hashicorp Vault — only Atlassian's Forge KVS.

Destructive actions

Recoup can take three destructive actions on users:

Deactivate user — calls POST /users/{accountId}/manage/lifecycle/disable on the Atlassian Admin API. Requires:
- An org-admin API key configured
- The caller cannot deactivate themselves (server-enforced)
- A reason of ≥ 10 characters (server-enforced, written to the audit log)
Revoke product access — planned v1.1, not active in v1.0
Mark as service account — does not touch Atlassian; only updates Recoup's local allowlist + flag on the user record. Reversible.

Every destructive action writes an immutable audit record before and after execution, capturing the admin's accountId, target accountId, action type, full before/after state diff, success/failure, and reason. Audit records cannot be edited or deleted from within the app.

Recoup never auto-takes destructive actions. All actions are admin-initiated; no automation or AI agent acts on its own.

AI processing (when enabled)

Both AI features are opt-in:

Service-account classifier

Model: claude-haiku-4-5-20251001
Data sent to Anthropic: accountId, displayName, email, boolean hasInteractiveLogin, list of product names (e.g. ["jira"])
Data NOT sent: issue contents, document contents, comment threads, last-active dates beyond the binary "has ever logged in" signal
Purpose: classify each user as human / service / bot / shared / unknown so admins don't accidentally deactivate bots

Cost insights summary

Model: claude-sonnet-4-6
Data sent to Anthropic: aggregate counts and dollar totals per recommendation category. No individual user data.
Purpose: generate the dashboard executive summary

If you disable the AI toggles in Settings, no data is ever sent to Anthropic by either feature.

Vulnerability reporting

Security vulnerabilities can be reported to security@tryrecoup.app. We commit to acknowledging reports within 5 business days and disclosing patches via the Marketplace "What's new" section.

Recoup is a solo-developer product as of v1.0. We do not currently operate a paid bug bounty programme.

Compliance

Recoup inherits the security and compliance posture of the underlying Atlassian Forge platform. Atlassian Forge is certified under:

SOC 2 Type II
ISO 27001 / 27017 / 27018
PCI-DSS (for the platform itself; Recoup does not handle payment data)
GDPR and CCPA compliance commitments

Recoup itself does not have independent certifications. The app code is reviewed by Atlassian as part of the Marketplace listing approval process.

Audit & change history

For your records, every code change to Recoup is reflected in the What's new section of the Marketplace listing for each version. The Marketplace partner portal also exposes a full version history for compliance audits.