Trust Center
Security overview, data minimization, retention, and how VelocityHero connects to Jira and Slack.
1. Security Overview
VelocityHero is designed for enterprise environments where delivery data must be protected.
Our approach is based on:
- Data minimization
- Controlled access
- Clear ownership boundaries
- Transparent infrastructure usage
VelocityHero analyzes delivery signals rather than replicating operational systems.
2. Data Access
VelocityHero connects to:
- Jira Cloud project metadata (issue status, transitions, sprint data, workload signals) — no assignee or reporter fields stored on issue rows
- Structured Slack check-in taps (signal values plus Slack user IDs used to build team-level metrics) — not Slack message history
VelocityHero does not require:
- Full Jira ticket replication
- Slack message history storage
- Source code access
- Attachments or document storage
3. Data Storage
VelocityHero is hosted on modern cloud infrastructure (primary application database in the EU — Ireland).
- Data encrypted in transit (TLS 1.2+)
- Data encrypted at rest (provider-managed encryption)
- Integration tokens encrypted at rest before storage
4. Data Retention
VelocityHero is not a Jira data warehouse.
- Jira sync cache: ephemeral — raw issue rows are kept ≤ 24 hours after a successful night run (typically the latest nightly snapshot only), then deleted.
- Long-term: team-level metrics, project state, coaching messages, and structured Slack check-in records used for multi-day delivery signals — not a multi-week copy of Jira issues or a Slack message archive.
- Account email: kept for login, recovery, invites, and transactional mail you requested.
- Disconnecting Jira or Slack removes the integration credentials and stops further sync; historical Service records are not automatically wiped by disconnect alone.
- After a trial ends (or on request after paid use ends), we typically retain organisation data for about 30 days to support delayed procurement or reactivation, then delete it using our erase-customer process unless you convert to a paid agreement or ask us to delete sooner.
5. Access Control
- Secure authentication for the VelocityHero web app (email-based account)
- Jira: OAuth 2.0 (3LO) — Connect Jira in onboarding; site-level read-only scopes. Legacy email + API token is not the self-serve default.
- Slack: OAuth-based app installation with workspace-scoped permissions
- Access limited to authorized users within the customer organization
6. Data Ownership
Customers retain ownership of their data at all times.
VelocityHero acts as a data processor for project-level delivery signals.
Customer Personal Data is not used to train artificial intelligence models except on the customer’s documented instructions (see DPA).
7. Subprocessors
VelocityHero relies on infrastructure and service providers to operate the product.
A current public list is maintained in our Subprocessor Register. Product providers that process customer Personal Data are covered by the DPA (including 30-day notice of changes). Website analytics providers used where VelocityHero is controller are listed separately and sit outside the customer DPA.
8. Incident Response
VelocityHero monitors system integrity and investigates confirmed security incidents.
Customers will be notified in the event of a confirmed data security incident.
9. Security Philosophy
VelocityHero is not a data warehouse.
We focus on delivery signals and structured metrics rather than content-heavy data storage.
By minimizing stored content — especially raw Atlassian API payloads — we reduce exposure while enabling insight.
10. Integration Requirements & Access Model
VelocityHero integrates directly into modern cloud delivery environments. This section outlines platform requirements, required permissions, and integration boundaries.
11.1 Supported Platforms
- Jira Cloud (Atlassian-hosted, .atlassian.net)
- Slack cloud workspaces
Not supported: Jira Server (on-prem), Jira Data Center, self-hosted Slack deployments.
VelocityHero is purpose-built for cloud-native delivery environments.
11.2 Jira Integration Requirements
VelocityHero connects to Jira Cloud via Atlassian OAuth 2.0 (3LO) and the Jira Cloud REST API (/rest/api/3/ and /rest/agile/1.0/) using the site cloudId resolved at connect time.
- Jira Cloud site the connecting user can access
- OAuth consent for VelocityHero’s declared read scopes
- Active project and associated board selected in onboarding
VelocityHero requires project-level access only. No Jira site-admin or global admin permissions are required beyond what OAuth grants for the authorized user. The connecting user must have access to the selected project and board.
VelocityHero requires jira_project_key and jira_board_id. Board access is used to retrieve active sprint information (Scrum) and validate configuration. Project access is used for JQL-based issue searches. Kanban boards are supported using project-level JQL queries.
11.3 Jira Data Access Scope
VelocityHero operates in read-only mode. The system uses read-only endpoints (GET and POST for JQL search), including: /rest/agile/1.0/board/{boardId}, /rest/agile/1.0/board/{boardId}/sprint, /rest/api/3/search/jql, /rest/api/3/project/{projectKey}, /rest/api/3/myself.
VelocityHero does not create or modify issues, update workflows, transition tickets, access attachments, access source code, or replicate full ticket history. Only structured delivery metadata (status, transitions, sprint data, points, flags) is analyzed. Assignee, reporter, and Atlassian account IDs are not stored on synced issue rows.
Raw synced issue rows are an ephemeral input cache. Long-term insight uses derived metrics and project state — see §4 Data Retention.
11.4 Slack Integration Requirements
VelocityHero integrates as a Slack app within a Slack workspace. Required: Slack cloud workspace; workspace-level app installation approval (as required by the workspace's security policy).
- chat:write — to post check-in prompts, delivery nudges, and weekly reports
- channels:read — channel selection and configuration
- groups:read — private-channel selection where used
- users:read — workspace user directory for team-size / membership context
- Interactivity endpoint — to receive structured responses from buttons/actions
VelocityHero does not request conversations.history, direct message history access, or broad message archive access. VelocityHero interacts only with structured signals submitted via configured check-in prompts.
11.5 Data Boundaries
- No full Jira ticket replication / multi-week issue warehouse
- No Slack message history storage
- No document or attachment storage
- No source code access
- No repository integration
The system analyzes delivery signals — not content archives.
11.6 Authentication Model
Jira: OAuth 2.0 (3LO) with refresh tokens stored encrypted; Connect Jira is the self-serve path (not email + API token first). Slack: OAuth-based app installation with workspace-scoped permissions. All integrations operate within the permissions granted by the customer.
VelocityHero account email (login) is separate from Jira OAuth: we do not persist the connecting Atlassian user’s email on the Jira connection for the OAuth path.
11.7 Customer Responsibility
Customers are responsible for ensuring appropriate project and board access, granting Slack app installation approval (if required), and managing who may connect integrations in their organization. VelocityHero operates strictly within the access permissions explicitly granted by the customer.
11.8 Architectural Principle
VelocityHero enhances delivery environments without altering them. The system reads delivery metadata, analyzes structured signals, surfaces insights, and nudges teams via Slack. It does not replace Jira, replicate Slack, or introduce a parallel workflow layer. VelocityHero is an augmentation layer, not an operational system of record.