Security Policy

1. Scope

This Security Policy describes the security architecture, data-handling practices, and operational controls for Variograma JiraChrono (“the Application”), developed and maintained by Variograma. It is intended to serve as a primary reference document for enterprise security reviews, vendor assessments, and IT procurement processes.

The Application is a native desktop client for Windows and macOS that enables users to record time and submit worklogs to Atlassian Jira Cloud via the official Atlassian REST API. Variograma does not operate any intermediate server, proxy, or backend service between the Application and Atlassian’s infrastructure.

2. Distribution & Software Integrity

The Application is distributed exclusively through official platform stores. No other distribution channel is authorised.

Platform	Store	Bundle / Package Identity	Signing
Windows	Microsoft Store	VariogramaLda.VRJiraChrono	Microsoft Authenticode (store-issued certificate)
macOS	Apple App Store	com.variograma.vrjirachrono	Apple Developer ID — App Store Distribution Certificate

Key supply-chain controls:

• Every release binary is reviewed and signed by the respective platform vendor (Apple / Microsoft) before publication. No unsigned or self-signed executables are distributed.
• Platform stores enforce cryptographic integrity at download and installation. Tampered packages are rejected automatically.
• Each published version is immutable and auditable; the full version history is retained by the platform store.
• Automatic updates are delivered exclusively through the platform store, ensuring users always receive vendor-verified binaries.

3. Application Sandbox & Privilege Model

The Application operates under the platform-enforced sandbox on both supported operating systems.

3.1 Windows — AppContainer / MSIX

• Packaged as an MSIX bundle and runs within the Windows AppContainer sandbox.
• No administrator privileges are required at installation or at runtime.
• The application declares no registry permissions beyond its own HKCU\Software\Classes entries.
• File system access is limited to the application’s own sandboxed storage directories and user-selected locations via standard OS file pickers.
• Network capability is declared as outbound HTTPS only to Atlassian endpoints.

3.2 macOS — App Sandbox

• The macOS App Sandbox (com.apple.security.app-sandbox) is fully enabled.
• No kernel extensions (kext) or system extensions are used.
• Declared entitlements are limited to: com.apple.security.network.client (outbound network), and com.apple.security.keychain-access-groups (credential storage).
• No com.apple.security.files.all or broad file-system entitlements are requested.

4. Authentication & Authorisation

4.1 OAuth 2.0 (3LO) Flow

Authentication is performed exclusively via Atlassian’s OAuth 2.0 three-legged (3LO) authorisation flow. Variograma never handles or stores user passwords.

1. The Application opens the user’s default browser and redirects to https://auth.atlassian.com for authentication.
2. After the user authenticates and consents, Atlassian issues an authorisation code and redirects to the registered callback URI (https://jirachrono.variograma.com/oauth-callback).
3. The callback page performs a server-side redirect to the application’s custom URI scheme (vrjirachrono://) carrying only the code and state parameters. No tokens are stored or logged on the web server.
4. The Application exchanges the authorisation code for tokens directly with https://auth.atlassian.com/oauth/token, entirely within the local process. No Variograma server participates in this exchange.

4.2 Token Scope

The Application requests the minimum OAuth scopes necessary for its functionality. Only the following Atlassian API scopes are requested:

• read:jira-work — read issues and worklogs the user has access to.
• write:jira-work — create and update worklogs on behalf of the user.
• offline_access — obtain a refresh token so the user does not need to re-authenticate on every session.
• read:me — read the authenticated user’s profile (display name, account ID).

The Application does not request administrative, project-management, or user-management scopes.

5. Credential & Secret Storage

OAuth tokens (access token and refresh token) are stored exclusively in the operating system’s native credential store. They are never written to disk in plaintext, logged, or transmitted to Variograma.

Platform	Storage Mechanism	Encryption at Rest
Windows	Windows Credential Manager (DPAPI)	AES-256 via DPAPI, tied to the user’s logon credentials
macOS	macOS Keychain	AES-256, protected by the user’s login Keychain password

Credentials are bound to the user’s OS session. They are inaccessible to other processes under a different user account and cannot be exported without the user’s explicit knowledge.

6. Network Communications

The Application communicates with Atlassian services only. There is no outbound communication to Variograma servers at runtime.

Destination	Purpose	Protocol
https://auth.atlassian.com	OAuth 2.0 token exchange	HTTPS (TLS 1.2+)
https://api.atlassian.com	Jira REST API (issues, worklogs)	HTTPS (TLS 1.2+)
https://<site>.atlassian.net	Jira site-specific API calls	HTTPS (TLS 1.2+)

• All connections use TLS 1.2 or TLS 1.3. Connections to servers presenting invalid or untrusted certificates are rejected.
• The Application performs no DNS lookups other than those required to resolve the Atlassian endpoints listed above.
• The Application does not open any listening ports. It is not a server and does not accept inbound network connections.
• No corporate proxy bypass is implemented. The Application honours system-level proxy settings.

7. Data Handling & Residency

• No data is transmitted to Variograma. All Jira data (issues, worklogs, comments) is exchanged directly between the Application and Atlassian’s infrastructure.
• Any data cached locally (e.g., recently accessed issue keys) is stored in the application’s sandboxed storage directory and is never transmitted externally.
• Data residency is governed entirely by the customer’s Atlassian tenancy configuration. Variograma has no access to or control over the customer’s Jira data.
• Uninstalling the Application removes all locally cached data and credentials.

8. Telemetry & Analytics

The Application collects no telemetry, crash reports, usage analytics, or diagnostic data. There are no embedded analytics SDKs, tracking libraries, or beacons of any kind.

Variograma does not have visibility into how end users interact with the Application, which Jira instances they connect to, or what data they access.

9. Third-Party Dependencies

The Application is built with .NET / .NET MAUI (Microsoft) and relies exclusively on platform-supplied and open-source libraries with permissive licences (MIT, Apache 2.0). No third-party analytics, advertising, or data-collection SDKs are included.

All third-party dependencies are resolved at build time and are statically linked into the application package. The dependency graph is auditable via the .deps.json manifest included in each release.

10. MDM & Enterprise Deployment

The Application supports silent, policy-controlled deployment through standard Mobile Device Management (MDM) platforms:

• Windows: Microsoft Intune, SCCM / Configuration Manager, or any Windows MDM provider via the Microsoft Store for Business / Microsoft Store for Education.
• macOS: Jamf Pro, Mosyle, Kandji, or any Apple Business Manager (ABM) compatible MDM via Volume Purchase Program (VPP).

IT administrators can enforce application updates, restrict installation to approved versions, and revoke access across the organisation without end-user interaction.

11. Compliance Reference

The following table summarises the Application’s alignment with common enterprise security controls. This information is provided to support vendor security questionnaires and procurement processes.

Control Area	Implementation
Software distribution	Apple App Store / Microsoft Store (exclusive)
Code signing	Platform-issued certificate (Apple Distribution / Microsoft Authenticode)
Sandbox enforcement	macOS App Sandbox; Windows AppContainer (MSIX)
Privilege escalation	None required at installation or runtime
Authentication protocol	OAuth 2.0 (3LO) via Atlassian — passwords never handled by Variograma
Credential storage	OS Keychain / Windows Credential Manager (DPAPI) — never plaintext
Data in transit	TLS 1.2+ enforced; certificate validation enforced
Network destinations	Atlassian services only (atlassian.com, atlassian.net)
Data storage (Variograma)	No customer data stored or processed by Variograma
Telemetry / analytics	None collected
MDM deployment	Supported — Intune / Jamf / ABM / VPP
Automatic updates	Platform store managed; auditable version history
Inbound network ports	None — the Application does not listen on any port
Third-party tracking SDKs	None included

12. Vulnerability Disclosure

Variograma encourages responsible disclosure of security vulnerabilities. If you believe you have identified a security issue in the Application or supporting infrastructure, please report it by email to jirachrono@variograma.atlassian.net with the subject line [SECURITY].

We commit to:

• Acknowledging receipt within 3 business days.
• Providing an initial assessment within 10 business days.
• Working in good faith to resolve confirmed vulnerabilities in a timely manner.
• Not pursuing legal action against researchers who comply with this policy and act in good faith.

Please do not disclose vulnerabilities publicly until Variograma has had a reasonable opportunity to investigate and remediate.

13. Security Contact

For security-related enquiries, enterprise security reviews, or to request supporting documentation (entitlement lists, App Store review details, dependency manifests), contact:

Variograma
Email: jirachrono@variograma.atlassian.net
Subject line: [SECURITY] for vulnerability reports, [ENTERPRISE] for procurement and audit enquiries.