FieldLock for Jira · version 1.0 · 23 August 2026
This is the Article 28 GDPR agreement between you, the customer (the controller) and Yzukar, the publisher of FieldLock (the processor). The unusual part is worth stating first: we have no access to your data at all. FieldLock is an Atlassian Forge app with no external backend, no analytics and no third-party services. Everything the app stores stays inside your own Atlassian instance, in your Atlassian region. We cannot read your issues, your field values or your log, and no copy of them ever reaches us.
This agreement applies automatically from the moment you install FieldLock, for as long as it is installed. If your procurement process needs a signed copy on your own paper, write to support@aphexcoding.tech and we will sign it.
| Item | Detail |
|---|---|
| Subject matter | protecting a chosen Jira field from unapproved change, and keeping a tamper-evident record of every change to it |
| Duration | for as long as the app is installed on your Atlassian instance |
| Nature and purpose | storage, comparison and append-only logging of field values inside your instance, plus generation of proof documents on your request |
| Types of personal data | Atlassian account identifiers of the people who act on a protected field, and any personal data your own users choose to type into a protected field or a reason field. Display names are read from Jira only at the moment a proof document is generated and are not stored. |
| Categories of data subjects | your employees, contractors and any other users of your Jira instance |
| Location | Atlassian-hosted storage belonging to your installation, in the Atlassian region of your instance |
Instructions. We process personal data only on your documented instructions. Your instructions are given through the app itself — your project settings, the field you protect, the approver role you choose — and through any written request you send us. We do not use your data for our own purposes, for analytics, for training any model, or for marketing.
Confidentiality. Access is limited by design rather than by policy: there is no channel through which your data could reach us. The only person who can read the app's data is someone who is already authorised in your own Jira instance.
Security (Article 32). The app runs on Atlassian Forge, which blocks external data egress by default. It has no external backend, no telemetry and no third-party services. The audit log is append-only and chained with SHA-256, so a removed or altered entry is detectable. Each installation generates its own random signing key for proof documents; that key never leaves app storage and is never displayed or logged. Infrastructure security, encryption at rest and in transit, availability and physical security are provided by Atlassian under its own programme, published at atlassian.com/trust.
Application logs. The technical logs our code writes, visible to us through Atlassian's developer tooling for a short retention period, contain issue identifiers, event types, entry numbers and hashes. They do not contain protected field values, reason texts, display names or the signing key. Where the app records that an unapproved change happened, it logs the fact that the old and new values differed — never the values themselves.
We use one sub-processor: Atlassian (Atlassian Pty Ltd and its affiliates), as the provider of the cloud infrastructure your instance and the app run on. You already have your own agreement with Atlassian covering that relationship.
We engage no other sub-processors. If that ever changes we will announce it on this page and in the app's Marketplace listing at least 30 days before the change takes effect, and you may object; if you object and we cannot accommodate you, you may uninstall the app and we will refund the unused part of your current subscription period.
We transfer nothing, because we receive nothing. App data stays in the Atlassian region of your instance and follows Atlassian's data residency arrangements for that instance. Any transfer question therefore falls under your existing agreement with Atlassian rather than under this one.
Data subject requests. Requests concerning content in your Jira instance are handled by you as the controller, using your own Jira administration tools — the data is in your instance, not ours. Where a request concerns something the app holds, we will help you locate, export or delete it.
Breach notification. If we become aware of a personal data breach affecting the app, we will notify you without undue delay and in any case within 48 hours, with what we know about the nature of the breach, the likely consequences and the measures taken. Breaches of the underlying Atlassian platform are notified to you by Atlassian under your agreement with them.
DPIAs and prior consultation. We will provide the information you reasonably need for a data protection impact assessment relating to the app.
App data lives as long as the app is installed. Uninstalling the app removes the app's storage, including the log. Export a proof document first if you need to keep the audit trail — you can export at any time from the FieldLock panel, and an active licence is not required to do so. We hold no separate copy to return or delete, because we never received one.
We will make available the information needed to demonstrate compliance with this agreement and will answer written security questionnaires. Because the app has no infrastructure of its own, an on-site audit of ours would show nothing relevant; the infrastructure is Atlassian's and is covered by the certifications and reports Atlassian publishes at atlassian.com/trust. The app's source behaviour with respect to data — what it stores, where and what it logs — is described in the privacy policy and can be verified in your own instance.
This agreement supplements the end user terms under which FieldLock is licensed. On questions of personal data processing, this agreement prevails over those terms. It does not change your separate agreement with Atlassian.
If this agreement changes, the version and date at the top change and the previous version is superseded; material changes are announced in the app's Marketplace listing.
Contact: support@aphexcoding.tech. FieldLock is published by Yzukar, an Atlassian Marketplace Partner registered in Poland; full legal and postal details are in our Marketplace partner profile and available on request.