Support: NexusGRC Compliance for Jira

1. What this page covers

How to reach us, how fast we aim to answer, and what we can and cannot see when you ask for help with the app. Problems in Jira itself or in Atlassian's platform are for Atlassian to fix; we will help you find the right channel.

2. How to reach us

For	Channel
Help with the app, a bug, a question	contact@nexusgrc.net
A security vulnerability	contact@nexusgrc.net (private channel). Do not open a public issue and do not put the details in a support ticket
A privacy request or question	contact@nexusgrc.net, see the privacy policy
Service status	No status page yet

The documentation of the app is at www.nexusgrc.net/jira/docs (English) and /jira/docs/fr (French).

3. Hours and languages

Support is by e-mail at contact@nexusgrc.net, Monday to Friday, 9:00 to 18:00 Paris time (CET/CEST), French public holidays excepted. We answer in English or French.

A business day is one of those days; a request received outside these hours counts from the start of the next business day.

4. Response targets (SLA)

Level	Meaning	First response
Critical	The app cannot be used by anyone on your site, or data may be lost or exposed	Within 1 business day
Other	A question, a defect with a workaround, a feature request	Within 3 business days

A first response is an answer from a person that acknowledges the request and says what happens next. It is not a fix.

Security vulnerabilities follow their own targets:

Step	Target
Acknowledge your report	3 working days
Confirm or reject it, with a severity (CVSS v3.1 base score)	10 working days
Fix, critical (CVSS 9.0 or more)	10 days from report or triage
Fix, high (7.0 or more)	4 weeks from report or triage
Fix, medium (4.0 or more)	12 weeks from report or triage
Fix, low (below 4.0)	25 weeks from report or triage

The four fix times are those of Atlassian's policy for cloud apps, counted from report or triage. The two acknowledgement targets are our own.

Security incidents that touch your data. We tell Atlassian without delay and within 24 hours at the latest, and update it at least every 6 hours while we contain the incident. We tell affected customers without undue delay. Our incident runbook is written and has never been exercised.

5. What to include in a request

• the name of your Jira site and the version of the app;
• the edition (Standard or Advanced) and whether the license is active;
• the tab or screen, what you did, what you expected and what happened, and the time (with the time zone);
• a screenshot with names and account details hidden, if it helps.

Please do not send passwords, tokens, or real customer data. If you are not sure whether something is sensitive, leave it out and ask.

6. What support can see

• What reaches us. We run no server that receives the data the app stores. Only the app's code, running in Atlassian Forge, processes it. We see function logs, which hold counts and codes only, and whatever you choose to send us for support. The one request that reaches a site we run is the gadget thumbnail (privacy policy, section 3).
• The function logs that we can read carry only counts, codes and the name of an error class, not names, accounts, ticket keys or project keys.
• So we work from what you choose to send. When we need more, we say exactly what and why, and we ask first. You can use the "Vos données" export of the "Journal" tab and send only the part that is relevant. The "Vérifier l'intégrité" button of the same tab tells you whether the audit-log chain is intact, and the result is something you can share without sharing the entries.
• We will never ask for your Atlassian password or an API token.

7. Known limits

Three limits of the app may explain what you see, and are worth knowing before you write:

• By default the access level of the app is "Reader", so any signed-in account of your Jira site can read the app's data and download evidence files, even with no role in the app, except the register of people, the audit log, the settings, the roles, the management system, the access-review campaigns and the objects read from JSM Assets. An administrator can choose "Contributor" so that each person reads only what is assigned to them. It stays inside your site.
• The AI assistant (Advanced edition) is limited by a token budget: when it is used up, you get a standard answer, without a model, until the 1st of the next month (UTC). A trial has 100,000 tokens for its whole duration.
• Without an active license the app is read-only: you can read everything and download evidence files, and every change is refused. Your data is not deleted. Routine clean-up continues: files uploaded and never attached, old reminder entries, and the roles of closed accounts.

---