Biller Plus

Biller Plus security and data

This page sets out Biller Plus security: where the data is kept, what leaves Atlassian, and who can see what.

Platform

Biller Plus uses Atlassian Forge: Forge functions, Forge SQL and Forge secret storage. Forge SQL provides one database per installation.

What leaves Atlassian

The app sends data out of Atlassian for alerts only. Every external call is declared in the app’s manifest.

  • Email alerts: to Furvur’s Broadcast server (broadcast.furvur.com), which sends through Amazon SES. Email alerts are opt-in per person.
  • Slack and Teams channel alerts (optional): to hooks.slack.com, *.logic.azure.com and *.environment.api.powerplatform.com.

The privacy policy lists what each alert contains.

Jira scopes (least privilege)

Scope Why
read:jira-work Worklogs, issues, search
read:jira-user Display names, user search
write:jira-work Create, edit and delete worklogs from the Biller Plus timesheet, as the signed-in user

Authorization

  • Every resolver loads the caller’s permissions server side: a Jira admin check through mypermissions as the user, and the Biller Plus roles (app admin, finance admin, project manager, team manager, employee).
  • Frontend context is never trusted for authorization.
  • Worklog writes run as the user, so Jira’s own “Work on issues” and “Edit/Delete own worklogs” permissions apply.

Financial privacy

Hidden rate mode prevents individual rates from being derived.

Email alerts

  • Opt-in per person. The address is validated and stored in that person’s prefs only.
  • The Broadcast API token is a Forge encrypted environment variable, never in code or logs.
  • Each send carries an idempotency key (the notification id), so queue retries never send twice.
  • Alert content is escaped HTML and never contains individual rates.

Slack and Teams

Webhook URLs are secrets in Forge secret storage, checked against the egress hosts above and only shown masked. Messages are escaped for Slack mrkdwn.

Xero and QuickBooks Online

Import files only. The CSV is made in the Forge function and downloaded by a finance admin with rate access, with formula injection neutralised. There is no connection and no egress.

PDF invoices

PDFs are made in the Forge function (pdf-lib, no egress). The logo must really be a PNG or JPEG (checked by its first bytes) of 300 KB or less. The audit log records that a logo is set, not the image.

Input safety

  • Jira ids are validated as numeric before use in JQL or REST paths.
  • REST paths are built with Forge’s route tag.
  • CSV exports neutralize spreadsheet formula injection.

Integrity

Forge SQL has no transactions, so every write is idempotent and safe to retry. Background jobs tolerate at-least-once delivery, and hourly reconciliation repairs missed events.

Audit

Changes to rates, budgets, projects, settings, roles, billing state and timesheet approvals are logged with actor, time and field-level old and new values.

Questions

Email support@transactful.com.

Coming soon to the Atlassian Marketplace

Questions first? Email support@transactful.com.