...
Retained tenant data is stored indefinitely, and may be removed at our sole discretion. Retained data may continue to be stored in the event that the tenant disables or uninstalls the add-on. Tenants may request permanent removal of retained data.
The add-on is packaged as a JavaScript client which executes locally in the user's browser. At report runtime, this client queries the JIRA host directly for report data on behalf of the user. Report data received from JIRA is temporarily stored in memory and discarded when the next report is loaded or when the user closes the browser.
...
Application and infrastructure
All The add-on is packaged as a JavaScript client which executes locally in the user's browser. At report runtime, this client queries the JIRA host directly for report data on behalf of the user. All communication between the add-on client and the JIRA host is SSL-encrypted and authenticated with JWT, using Atlassian Connect APIs. All
All communication between the add-on client and add-on server is SSL-encrypted and authenticated with JWT according to Atlassian recommendations.
...