Skip to main content

Security Policy

This Security Policy outlines the measures and procedures put in place by TNG Technology Consulting GmbH (“TNG”) to ensure the security of data processed by our Server/Data Center and Cloud apps as well as the Server/Data Center and Cloud apps itself. We take security seriously and are committed to protecting our Server/Data Center and Cloud apps from security threats.

If you become aware of any security incident, please report it to us via promptly.

Security programs

  • We aim to have all our Cloud apps participating in Atlassian’s security bug bounty program. A bug bounty program is one of the most powerful tools to help detect vulnerabilities in applications and services. It continuously improves the security posture by leveraging crowdsourced vulnerability discovery methods.

  • All of our Cloud apps take part in internal penetration testing sessions which are conducted by IT experts from TNG who do not work on our Cloud apps on a day-to-day basis.

Vulnerability management

Data protection

  • All of our Cloud apps are written using Atlassian Forge.

  • In particular, they are hosted by Atlassian and keep all data in Atlassian’s infrastructure. Therefore, all data stored and processed by these apps remains in Atlassian’s infrastructure.

  • Apps for Server and Data Center are installed directly in the End User’s Atlassian system. Therefore, all data stored and processed by these apps remains in the End User’s infrastructure.

  • In principle, our apps do not transmit any data to us or any other external third-party system. If transmissions to external systems are a functional part of the app, they happen transparently, encrypted in transit and under the customer’s control.

  • You can find more information about this in our Privacy Policy.

Data resilience

  • As all data of our Cloud apps is stored within Atlassian’s infrastructure, we rely on on Atlassian’s backup and recovery mechanisms.

  • As all data of our apps for Server and Data Center is stored within End User’s infrastructure, we rely on on the End User’s backup and recovery mechanisms.

API key management

  • Any third party API keys provided by the end user will remain in the apps and will only be used for the agreed use in the apps.

Internal security measures

  • We have laid down an internal security policy and implemented response protocols to respond to security incidents promptly and effectively.

  • All employees have committed themselves to confidentiality, in particular regarding personal data.

  • Knowledge on data protection regulations is maintained with yearly briefings.

  • We make use of single sign-on (SSO) and multi-factor authentication (MFA) with hardware tokens for all personalized accounts.

  • All personalized accounts have individual passwords that must fulfill current recommendations for secure passwords.

  • Our workstations are individually assigned and not shared between employees.

  • Data on hard drives of all workstations is fully encrypted.

  • Security patches are installed regularly.

  • All employees are ordered to lock their workstations on absence.

  • Access is granted by roles. We follow a “need to know” principle and only grant access to information if it is absolutely required for an employee to conduct their official duties.

  • When developing our apps, we strictly separate development, staging, and production environments.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.