Security
Daylight runs entirely on Atlassian. This page describes where your data lives, who can see it, and how we build and fix the app.
Where your data lives
- Daylight is built on Atlassian Forge and is part of the Runs on Atlassian program. It has no external servers, no remote back end, and no data egress.
- Time entries are standard Jira worklogs. Daylight's own data, such as timers, settings, accounts and the audit log, is in Atlassian Forge storage.
- Atlassian encrypts this data at rest and keeps it in your Atlassian data-residency region.
- Atlassian is our only sub-processor. Atlassian's security commitments apply to the platform: atlassian.com/trust.
- Modul4r keeps no copy of your data and has no routine access to it.
What Daylight can do in Jira
Your Jira admin sees and approves these permissions at install.
| Permission | Why Daylight needs it |
|---|---|
| Read and write Jira work | Find issues and projects for your timesheet. |
| Read and write worklogs | Log, edit and delete your time as real Jira worklogs. |
| Read Jira users | Show names on timesheets, approvals and reports. |
| App storage | Keep timers, settings, accounts and the audit log. |
| Personal data reporting | Erase data for Atlassian accounts that are closed. |
Daylight sends no notifications and makes no calls outside Atlassian.
Who can see what
- Each person sees their own time. Time is logged as that person in Jira.
- Approvers see the timesheets they approve. A team approver sees only the members of their teams.
- Only Jira site admins and Daylight config admins can change settings, rates and accounts.
- Cost figures show only to people who can see the rate settings.
- The audit log records every time entry added, changed or deleted, in Daylight or in Jira, for 13 months.
Your data when people leave or you uninstall
- Each week, Daylight runs Atlassian's personal-data check. If Atlassian reports an account as closed, Daylight erases that person's data.
- If you uninstall Daylight, Atlassian removes the app's stored data. Your Jira worklogs stay in Jira.
- Daylight uses no AI or machine learning on your data.
How we build and release
- Every company account uses multi-factor authentication.
- Automated tests run on every change. Nothing ships with failing tests.
- Each release gets a dependency scan and a check against the OWASP Top 10.
- Each release is compared file by file against the previous one, dependencies included. A change that the source code does not explain blocks the release.
- A secret scanner runs on every push. Daylight holds no API keys of its own.
Report a security problem
Email support@modul4r.com. You can also report through Atlassian's ecosystem portal or bug bounty. We reply within 2 business days and triage within 2 weeks. We fix problems within Atlassian's deadlines for cloud apps:
| Severity | Fixed within |
|---|---|
| Critical | 10 days |
| High | 4 weeks |
| Medium | 12 weeks |
| Low | 25 weeks |
If an incident affects your data, we tell Atlassian within 24 hours and tell you within 72 hours where possible.
Not in place yet
Daylight has no penetration test, compliance certification or external audit yet.
A data processing agreement (DPA) is available. Email support@modul4r.com. See also the Privacy Policy.