NexusGRC · Legal document
Subprocessors: NexusGRC Compliance for Jira
Last updated : November 1, 2026
1. Subprocessors
The app has no server of ours and its manifest declares no remote service, no external provider and no external permission. Every call the app makes goes to Atlassian.
| # | Subprocessor | Service used by the app | Customer data involved | Location |
|---|---|---|---|---|
| 1 | Atlassian | Forge platform: runs the app's functions, Forge SQL (one database per installation) and Forge object storage | All Customer data the app holds | Compatible with Atlassian data residency: the same place as the host Jira, and it moves with it if an administrator moves it. Forge aims to run the functions in the same location and may sometimes run one elsewhere for reliability or security |
| 2 | Atlassian | Forge LLMs, for the AI assistant of the Advanced edition only | The texts listed in section 4 of the privacy policy: for each function, the text of the one object the person asks about, after the app has removed e-mail addresses, web addresses, account identifiers and mentions and replaced the people the object names by their role. Never the content of files, the audit log, access reviews, the register of people, vendors or incidents | Not established |
| 3 | Atlassian | Personal data reporting API, called by the daily run | Opaque Atlassian account identifiers and the date of the personal data held; each account is reported again once 7 days have passed since its last report, as the daily run's time allows | Atlassian's platform |
No other subprocessor receives Customer data from the app.
What is not established. For the AI assistant (row 2): where Atlassian processes the requests, how long it keeps them, whether it uses them to train models, and which other company runs the model inside Atlassian's service. We make no claim about them. Atlassian documents its service at Forge LLMs.
The contracting entity of Atlassian. We do not restate which Atlassian entity contracts with us or which entity provides each service. Atlassian publishes its own terms and lists:
- Atlassian's list of sub-processors;
- Atlassian's Data Processing Addendum and its Forge Data Processing Addendum;
- Forge data residency.
2. Not subprocessors, stated for accuracy
The Jira site itself. The app is installed in the Customer's Jira. The reminder e-mails are sent by Jira, not by the app, which keeps neither the account nor the address of the recipient.
The dashboard gadget thumbnail. Jira requires an absolute address for the thumbnail of a gadget. Ours is
https://academy.nexusgrc.net/icons/nexusgrc-compliance-192.png, a static image served by a website we operate and that is hosted on Vercel.
- The app does not load this image and sends nothing to that address. The browser of the person who views the gadget requests it, as for any image on the web.
- The app puts no Customer data in the request. Like any image request, it lets the server that serves it receive technical data such as the IP address and the browser type and, depending on the browser's referrer policy, the address of the page that shows it. Vercel Inc. (United States) hosts that website and acts as our processor for this request, under its data processing addendum and the 2021 standard contractual clauses. It keeps technical request logs for a short period under its own terms; we do not use them to identify anyone.
Other NexusGRC products. The NexusGRC SaaS platform and the Academy site are separate and are not part of this app.
3. Changes to this list
When we intend to add or replace a subprocessor, we update this page and the date shown at the top. We give at least 30 days' notice, and you may object within that period, as section 5 of the data processing agreement sets out. Contact: contact@nexusgrc.net.