Built from the ground up with security in mind

Troopr sits between Jira and Slack and does not hoard the raw content of your messages. It derives and persists a structured set of facts about how your team works, the information it needs to draft updates and keep Jira current, and nothing more.

Troopr's access to issues and fields is controlled by your Jira permissions and never bypasses them, so you always control access. Authentication uses OAuth and documented public REST APIs.

Yes. Troopr supports single sign-on for a seamless login experience, so there is no separate account or password to manage. Administrators can also assign roles using role-based access control on the principle of least privilege.

Yes. Administrators set roles with role-based access control so people see only what they need, and Troopr keeps audit logs of access and administrative actions, available to customers for security and compliance review.

All communication uses TLS 1.2 / HTTPS. All stored data is encrypted at rest with AES-256, including relational databases, file stores, and backups. Keys are generated and managed by AWS KMS and rotated once a year.

Troopr is hosted in AWS data centers. The hosting environment maintains ISO 27001, FedRAMP authorization, PCI certification, and SOC reports, and AWS restricts physical access to authorized personnel.

For organizations still on Jira Data Center, Troopr's Enterprise self-hosted deployment runs as a Docker image inside your network and can connect to a Data Center instance, so your team keeps working as you migrate to Jira Cloud. Atlassian is ending Data Center support on March 28, 2029, with expansions for existing Data Center customers until March 30, 2028, so this is best treated as a bridge through that move. It is configured as part of an Enterprise agreement; reach our team at security@troopr.io or through the demo page.

Customer data is stored in multi-tenant datastores and assigned a unique tenant token, which prevents one customer from accessing another customer's data.

Production access is limited to a small group and granted only through signed permission, with a documented quarterly account review. Personnel with access must agree to confidentiality terms, pass a background screening, and complete security training. All access is removed immediately on termination.

Any vendor that could access sensitive client data must provide an external audit or, at minimum, complete a risk interview and demonstrate best practices. These are refreshed annually, and every vendor signs a Data Processing Agreement.

Troopr scans its systems regularly and patches automatically, prioritizing critical and high-severity fixes. An in-app security platform detects and blocks attacks, helping prevent data breaches, account takeovers, and business logic attacks.

Yes. Troopr partners with external penetration testing vendors for annual tests. Medium and higher severity findings are remediated, with reports available under NDA.

Backups run daily, encrypted in transit and at rest, with regular tests, stored off-site on Amazon S3. Troopr reviews its Business Impact Analysis and Business Continuity Plan annually and maintains defined Recovery Time and Recovery Point Objectives. Reports available under NDA.

Troopr maintains and verifies its incident response policy, rehearsing potential incidents twice a year. Any confirmed data breach would be communicated to a client's Troopr administrator within 24 hours.

Security is built into development. OWASP Top 10 risk classification validates new code before deployment, all code is version-controlled with peer review and continuous integration testing, and developers complete specialized security training.

An independent firm conducts an annual SOC 2 Type II audit covering the Common Criteria plus Confidentiality and Privacy. Troopr also runs quarterly internal audits, with well-defined, documented roles for data protection.

Yes. Troopr runs an active bug bounty program with ethical hackers, evaluating and remediating submissions by severity. Report a vulnerability to security@troopr.io.