Pathfinder data and security · Bushcraft Software

DRAFT. This page is pending legal review and isn't in effect yet. Our apps haven't launched.

Where it runs	Atlassian Forge. Pathfinder runs on Atlassian's cloud infrastructure and qualifies for the Runs on Atlassian badge: no outside servers, no remote calls, no outside sign-in.
What it reads	Users: account ID, display name, active or deactivated, and account type (person, app or customer) Email addresses, while the "Collect email addresses" setting is on (it is on by default) Groups and group membership, and which groups give product access Projects, project roles and who holds each role Permission schemes and the global permission catalog Jira's own permission check, to confirm the access Pathfinder works out ("Verified by Jira")
What it changes	Nothing. Every Jira permission Pathfinder asks for is read-only, and the app has no write, delete or admin scopes.
What it stores	Snapshots: a compressed, hashed record of who had what access at the time of each scan, in Forge storage Retention: the last 10 manual snapshots; scheduled snapshots, all for 90 days, then the first of each month for 13 months. Snapshots you pin as audit evidence are kept until you unpin or delete them. You can change these limits. An audit log of settings changes, scans and exports (who, when, scope, row count, file hash), kept for 400 days App settings and scan progress. Scan working data expires within days. Excel exports are built in your browser and downloaded by you. Pathfinder does not keep a copy.
What leaves Atlassian	Nothing. Pathfinder makes no calls to servers outside Atlassian, and its manifest declares no outside connections.
Who at Bushcraft can see it	No one at Bushcraft Software can see your Jira data. We only see what you choose to send us in a support request.

Specific to Pathfinder

Only Jira administrators can open Pathfinder. It checks that you are an administrator on every request, and a scheduled scan stops if the person who set it up is no longer an administrator.
Turning off "Collect email addresses" stops Pathfinder storing any email address, and offers to remove them from existing snapshots. The email permission still appears on the install screen, because Forge has no optional permissions.
When Atlassian reports a closed account, Pathfinder replaces its name with "Closed account" and removes its email from every snapshot.
Pathfinder's logs hold no personal data: only job IDs, stages, counts and durations.

Data residency

Pathfinder keeps its data in Atlassian Forge storage, which Atlassian hosts. Where Atlassian supports data residency for Forge apps, that data follows the region of your Atlassian site.

Uninstalling

When you uninstall Pathfinder, Atlassian deletes the data it stored in Forge storage, following Atlassian's Forge data retention rules. Pathfinder leaves nothing behind in your Jira configuration that it didn't already find there.

Privacy policy and terms
How all our apps handle data
Questions: support@bushcraftsoftware.com

Last updated 2026-10-27

Pathfinder: data and security

Specific to Pathfinder

Data residency

Uninstalling

More