ikuTeam Trust Center

1. ARCHITECTURE & DATA FLOW

ikuTeam apps follow a single security principle: Forge-native execution, zero content storage, and strict permission integrity. All data moves directly between the end-user’s browser, Atlassian Cloud, and—when relevant—your cloud-storage provider. No ikuTeam server ever stores customer content.

Need a deeper technical review? Open a Security Ticket to request an Architecture Walk-through or Pen-test Report.

(Applies to every ikuTeam app; verified under Atlassian Cloud Fortified)

Control	Detail
In-Transit Encryption	TLS 1.3 (1.2 fallback) for every network hop—browser ↔ Atlassian ↔ Microsoft / Google APIs.
Token Security	OAuth 2.0 tokens are encrypted and stored only in each tenant’s Forge key vault—never exported.
At-Rest Encryption	Content remains encrypted with AES-256 by Atlassian or the customer’s storage platform (SharePoint, Google Drive, etc.).
No Shadow Infrastructure	ikuTeam maintains zero persistent databases, caches, or content mirrors.

Choose a tab to see the security model that applies to each family.

Family	Includes	Core Data-Flow Model	Key Admin Switches
ikuTeam Files	Google Drive / Sharepoint / OneDrive / Box / Dropbox / Egnyte Connectors, Attachment Workflow Automation, Google Docs, Google Sheets	Real-time streaming via short-lived signed URLs; tokens stored in Forge; no content cached.	Toggle editing & external drives, auto-provision folders, force read-only/download blocks
ikuTeam Office	ikuTeam Office, Excel, PDF Editor	Files stay stored inside Jira/Confluence attachments;	Enable/disable editing, workbook-diff rotation, PDF signature & audit export
Rovo AI	Rovo Assistant (SharePoint documents)	Documents are processed in-memory with Atlassian Rovo. Summaries are temporary and never stored or shared.	Disable per Space/Project, PII/PHI redaction presets

A detailed flow diagram for each family appears in its respective tab below.

Data Type	Where Stored	Default Retention	Notes
OAuth Tokens	Atlassian Forge encrypted KV	Until app uninstalled or token revoked	GDPR Art. 6(1)(b) basis
File Metadata	Confluence / Jira page storage	Life of the page	Never leaves Atlassian realm
File Content	Never stored by ikuTeam	N/A	Access via customer-signed URLs only
Operational Logs	Atlassian Log Pipeline	90 days, auto-purge	Contains no customer content

2. CERTIFICATIONS, COMPLIANCE & IMMUTABLE CONTROLS

ikuTeam’s trust program is grounded in third-party audits, published road-maps, and the inherited security posture of Atlassian Forge. Unless noted otherwise, every control, certification, and commitment below applies equally to all ikuTeam product families (ikuTeam Files, ikuTeam Office, and Rovo AI).

Framework / Standard	Status	Scope & Coverage	Next Formal Review
ISO 27001:2022	In progress	Full ISMS: product dev, cloud ops, incident response	Q2 2026 (certification), then annual surveillance
SOC 2 Type II	Road-map – gap analysis complete	Security, Availability, Confidentiality	Audit kickoff Q4 2026
GDPR / CCPA	Compliant	DPA, SCCs, data-subject rights, breach notice	DPO review every 12 months
HIPAA	Enabling	Zero-data storage architecture: No PHI is stored or processed on ikuTeam servers.	Semi-annual architectural review.
Atlassian Cloud Fortified	Certified	24 × 7 uptime, vulnerability scans, 1-hour incident updates	Verified annually by Atlassian
Regional Data Residency	Supported	EU, US, Germany, Australia (Forge zones)	Canada & UK zones H1 2026
Sub-processor Register	Public	AWS, Atlassian Cloud, Mailgun, (full list PDF)	Live; updated immediately

Family	Additional Call-outs
ikuTeam Files	Aligns with Microsoft 365 EU Data Boundary, supports Purview & Google Workspace logs.
ikuTeam Office	All data stays inside Jira/Confluence attachments; immutable Page/Issue History.
Rovo AI	Extra PII and PHI redaction with region-aware processing through Atlassian Rovo. No customer data is stored or used for model training.

3. PRODUCT-SPECIFIC SECURITY NOTES

ikuTeam ships three product families. Each follows the global controls in Section 2 but also carries the family-level guarantees below. Tables are intentionally uniform to help auditors compare at a glance.

Need deeper technical docs? Request via the Support Portal.

Apps: ikuTeam Files, SharePoint Connector, Google Drive Connector, Box / Dropbox / Egnyte Connectors, Google Docs / Sheets

Security Aspect	Policy & Technical Detail
Data Residency / Storage	No file data is ever stored by ikuTeam. Content stays in SharePoint, Google Drive, Box, Dropbox, Egnyte, or Atlassian. Only per-user OAuth tokens are stored in Atlassian Forge’s encrypted key-value store.
Permission Handling	Real-time mirroring of source-platform ACLs. Admin switches: force read-only, block downloads, auto-provision project folders.
Encryption & Transport	TLS 1.3 end-to-end. File access via signed URLs (< 15 min TTL) or embedded viewers.
Scoped OAuth Access	No mailbox, calendar, or directory scopes. Granular file scopes only; consent per user & tenant.
Compliance Extras	Supports Microsoft 365 EU Data Boundary, Purview audit logs, Google Workspace log events, Power Platform DLP alignment.
Admin Controls Recap	Toggle external drives / editing / Rovo per space or project Export 30-day audit CSV Tenant-restriction header

Apps: ikuTeam Office, Excel, PDF

Security Aspect	Policy & Technical Detail
Data Residency / Storage	Files remain solely in Jira/Confluence attachment storage—never copied or cached externally.
Permission Handling	Inherits native space / project / attachment rights. Live permission check aborts editing if access is revoked mid-session.
Encryption & Transport	TLS 1.3 browser ↔ Atlassian; AES-256 at rest (handled by Atlassian). WebAssembly editor runs client-side; no outbound calls.
Scoped Access	Zero third-party scopes; execution sandboxed inside Forge. Excel Sheets diffs encrypted; rotated daily.
Compliance Extras	SOX-ready audit export (CSV), eIDAS-compliant PAdES signatures (PDF Editor), immutable edit history in Confluence / Jira.
Admin Controls Recap	Enable/disable editing per space/project Configure diff-retention window (Excel) Toggle PDF signature requirement

App: Rovo Assistant (SharePoint-based summaries)

Security Aspect	Policy & Technical Detail
Data Flow & Storage	Document streamed in 1 MB encrypted chunks; processed in-memory only. No content or summary persisted by ikuTeam or the model.
Permission Handling	Rovo inherits SharePoint ACLs; users without access cannot request or view a summary.
Encryption & Transport	TLS 1.3 Forge ↔ Azure OpenAI; processing pinned to the same region as the Atlassian tenant.
Scoped Access	Limited to SharePoint file scopes; Rovo never requests broader Graph permissions. Model never trains on customer data.
PII / PHI Safeguards	Regex-based redaction layer (15+ patterns). Requests abort on match; admin may tune rules or disable Rovo entirely.
Admin Controls Recap	Global or per-space/project toggle Enable healthcare / legal redaction presets View summary-access events in audit log

4. UPTIME, INCIDENT RESPONSE & ATLASSIAN STATUS

ikuTeam apps are Cloud Fortified, so availability, maintenance, and incident comms are handled through Atlassian’s own infrastructure. You get a single source of truth—no separate dashboards to track.

At ikuTeam, we believe that great support is part of a good customer experience, and we do our best to reply quickly to our customers.

Our SLA for requests sent by email or opened directly in our support portal is:

Response time (working hours)	Response time (working days)	Event
<8	1	First response from a support agent.
<24	3	Resolution of general requests.
<80	10	Resolution of requests related to bugs in the app.

Service credits follow Atlassian Cloud Fortified Terms—submit a Support Ticket within 30 days of breach to claim.

5. CONFIDENTIAL DOCUMENT CENTER

Some evidence is too sensitive to publish openly (network diagrams and pentest results). We surface it through a support portal so your auditors can verify controls without exposing production details.

Category	Artefacts (examples)	Refresh Cycle
Compliance & Certifications	ISO 27001 Statement of Applicability, GDPR/CCPA DPA, Sub-processor Register	SoA ➜ quarterly DPA ➜ annually
Security Testing	External Pen-test Executive Summary, Atlassian Forge AppSec Review Letter	Pen-test ➜ annual Forge letter ➜ per Atlassian cycle
Cloud Architecture & BCP	High-level system diagrams (Jira/Confluence), DR/BCP plan	Annually or after major infra change
Policies & Procedures	Secure SDLC SOP, Incident-Response Plan	Semi-annual
Roadmap & Audits	SOC 2 Type II timeline, HIPAA BAA program outline	Live tracker

(All files are water-marked, read-only, and may be lightly redacted.)

6. CONTACT, ESCALATION & DOCUMENTATION ACCESS

ikuTeam runs a Support-Portal–first model: every technical, compliance, or licensing request is routed and audited through the same secure queue—no email silos, no lost threads.

7. FREQUENTLY ASKED QUESTIONS (FAQ)

Below are the questions most security, compliance, and admin teams ask during evaluations. If you need deeper detail, open a Support Ticket—we’ll turn it around fast.

Still have questions? Reach our security team anytime at security@ikuteam.com or open a ticket in the Support Portal.

Ready to Collaborate Securely in Atlassian?

ikuTeam already powers secure file collaboration for 12,000+ teams worldwide — from regulated healthcare providers to Fortune 500 engineering organizations.
If you’re ready to validate us for your own environment, everything you need is just a click away.

If you need:

• Detailed security documentation – ISO SoA draft, pen test summary, DPIA templates
• Custom audit evidence or NDA-protected content
• A live architecture or risk review with our CISO

Open a Security Ticket

Need something bespoke? Email us at support@ikuteam.com or drop a note in the portal — we respond within 24 hours on business days.

Last updated: 24 March 2026 • Maintained by the ikuTeam Security & Compliance Group • All claims independently reviewed under the Atlassian Cloud Fortified program.

Security andcompliance you can count on

1.1 Global Encryption & Transport Controls

1.2 Global Admin Controls - at a glance

1.3 Product Families (overview)

1.4 Data Residency & Retention

2.1 Global Certifications & Regulatory Alignment

2.2 Immutable Security Controls

2.3 Family-Level Compliance Notes

2.4 Audit Pack, Questionnaires & Proofs

3.1 ikuTeam Files Family

3.2 ikuTeam Office Family

3.3 Rovo AI Family

4.1 Status Information — Where to Check

4.2 SLA & Priority Definitions (Cloud Fortified Baseline)

4.3 Security Incidents & Bug Bounty

5.1 What’s Inside

5.2 How Access Works

6.1 Support & Documentation Requests

6.2 Vulnerability Disclosure

6.3 Escalation & SLA References

6.4 Enterprise Security Reviews

Does ikuTeam ever store our files or document contents?

How are permissions enforced for external cloud files?

What encryption do you use in transit and at rest?

Where is data processed, and can we pin residency?

Can we disable features like Rovo AI, external drives, or in-place editing?

Do your apps support IP allow-listing or Atlassian access policies?

What certifications do you hold today?

How long do you keep operational logs?

What is your vulnerability-response target?

Security and
compliance you can count on