This is expected to be in place before end of year 2022.
Permissions Smart Guess requires and why it’s needed?
The following table describes the permissions Smart Guess requires and why they are needed:
Why is it needed?
Share data with domain: api.smartguess.is
Smart Guess Realtime Engine shares key user actions with team-members taking part in the estimation, when it happens.
This is critical so that all team members can see who has joined, who has given an estimate, etc.
The Realtime Engine, doesn’t process or store any personal data, in line with the GDPR principle of 'purpose limitiation'.
View Jira issue data
Allows Smart Guess to read the issue key in order to retrieve current state of the planning session for the issue. Furthermore retrieve current story point value to show users if story points needs saving.
View user profiles
Used to identify who has joined the planning session, who has given an estimate and retrieve users name, profile picture displayed to users.
Notice that Smart Guess does not store any personal data. Only retrieves it on demand, in line with GDPR principle of ‘data minimisation’.
Create and manage issues
Allows Smart Guess to:
check if the story point field can be updated
save the story point value selected
App storage scope
Allows Smart Guess to store current state of the planning session for the current issue. In other words; what users have joined and their estimates.
Notice that Smart Guess does not store any personal data. Only retrieves it on demand, in line with the GDPR principle of data minimisation.
Write Jira User Property
Used to track if the current user has already seen
user onboarding messages
new release messages
So that these messages are only displayed once for each user.
Write Jira Field
Used to keep the following information up to date:
Estimated by - who has estimated the issue
Why other apps on the marketplace do not require “Allow access”?
Jira Cloud apps that don’t ask users to “Allow access” are built using the older Atlassian Cloud framework, Atlassian Connect. With Connect the app servers and data are operated and stored by the app developer in the ‘Public Cloud.’ Atlassian is moving away from this setup and is working towards a more robust setup and Unifying Atlassian Connect and Forge. With the new Forge framework, Atlassian is:
New apps built on Forge fundamentally differ from ones built using the Atlassian Connect cloud development framework. With Forge, apps are built and run within the boundaries of Atlassian’s cloud platform, unlocking new benefits for developers and customers.
Forge lets developers keep customer data hosted in the Atlassian cloud, making it easier to comply with GDPR and other regulatory requirements. Atlassian is working towards SOC2 certification for Forge and making Forge meet the needs of customers’ data residency requirements in the future.
So why do other apps on the marketplace not require “Allow access”?
Other apps built using Atlassian Connect store customer data on their servers in the ‘public cloud.' Even so, users of these apps are not informed about this in the same way as users of apps build on Atlassian Forge are:
“share data with 1 domain outside of Atlassian”
Furthermore, individual users don’t have to accept sharing data with domains outside of Atlassian, even though most, if not all Atlassian Connect apps do.
The good thing is Atlassian is strengthening the security profile of all apps and will eventually unify Atlassian Connect and Forge apps and have them comply with the same strict security policies.