Where your data lives
Short version: inside your own Atlassian tenancy, and nowhere else. Fulfilra makes no call to any service outside Atlassian, because it has nowhere else to call.
Where the data sits
One database per installation
Atlassian provisions Fulfilra a database inside your tenancy. It holds your site's data and no other customer's — there is no shared store, so there is no other tenant's data present to leak.
No egress, at all
No analytics, no error tracker, no email provider, no CDN, no vendor backend. The app's manifest declares no external permissions, and an automated check fails the build if one is ever added.
No credentials to hold
Fulfilra stores no password, no API key and no token. It acts through Atlassian's own identity, scoped per invocation.
The Jira permissions it asks for
Four, each justified. It asks for nothing it does not use.
| Scope | Used for |
|---|---|
read:jira-work | Reading the project you nominate and the issues linked to requests |
write:jira-work | Creating the issue for a request, and asking Jira to notify people about it |
read:jira-user | Showing display names instead of account ids, and spotting approvers who have been deactivated |
storage:app | Fulfilra's own database, inside your tenancy |
It never uploads a file to Jira on your behalf, and never reads a project you have not connected it to.
Who can see a request
Separation between people on the same site is enforced in the query itself, not filtered out afterwards.
A requester
Sees their own requests only. A colleague's request is not merely hidden from the list — it is indistinguishable from one that does not exist. Page counts and totals reflect only what they may see.
Agents, approvers, administrators
See every request on the site. Approvers get the queue read-only, so they can put a decision in context without being able to work requests.
Internal notes
Never rendered to a requester and never notified to them. A Jira comment marked internal is never mirrored across.
Provenance cannot be forged
A comment that came from Jira is labelled as such, and no user-facing path can set that label — so nobody can post a comment that renders as coming from the service desk.
Attachments: read this one
Fulfilra's request form has no file picker — the Forge UI toolkit has none. A requester attaches files to the linked Jira issue instead.
That means anyone who can browse that Jira project can see the file, which is usually a wider audience than the people handling the request. Fulfilra states this on the admin screen at the moment you enable issue creation, and on the request itself where the requester will read it.
If you handle genuinely sensitive attachments — occupational health, payroll disputes — restrict the project accordingly, or route those request types to a project with tighter browse permissions.
What happens on uninstall
Atlassian deprovisions the app's database with the installation. Your requests go with it.
There is no copy anywhere else, because there was never anywhere else. Export anything you need to keep before uninstalling.
Support
Support runs by email at support@fulfilra.comand through the Marketplace listing. There is no in-app support desk, on purpose: sending your ticket text to a vendor's system would be exactly the data egress this page promises does not happen.
What the badge means
Runs on Atlassian is Atlassian's own designation for apps that keep customer data inside Atlassian's infrastructure and make no external calls. Atlassian detects eligibility from the app's manifest — it is a property of how the app is built, not a claim a vendor writes on a website.
For your review process, that means the usual vendor questions have short answers: there is no sub-processor, no data-transfer agreement to negotiate, no vendor breach that could expose your requests, and no separate uptime to depend on. Fulfilra is up exactly when your Jira is.
Put it through your review
Install the Free edition on a test site and hand it to whoever asks the security questions.