Security Architecture & Disclosure Policy
Publisher: Nordic ERP Integration Solutions AS (Oslo, Norway)
1. Cloud Security Posture
The Klarlink Nordic ERP Integration Suite (Tripletex for Jira & Tempo, Visma Severa for Jira & Tempo, PowerOffice Go for Jira & Tempo) is built 100% on Atlassian Forge.
Hosting Environment
Runs exclusively in Atlassian's secure multi-tenant cloud environment with automated scaling and compute isolation.
Data at Rest
Encrypted using AWS KMS-managed keys via Atlassian Forge Key-Value Storage (@forge/kvs).
Data in Transit
Strictly enforced TLS 1.3 encryption across all inbound webhooks and outbound ERP API calls.
Tenant Isolation
The Forge runtime isolates storage, compute, and encryption keys strictly by Jira Cloud site Ari (app.id and installation context).
Network Egress Whitelist
Restricted strictly to declared official ERP API hosts (tripletex.no, api.severa.visma.com, api.poweroffice.net) and api.tempo.io.
2. 72-Hour Security Incident Response SLA
In compliance with the Atlassian Marketplace Cloud Security Requirements and GDPR Article 33:
- In the event of a confirmed security incident or personal data breach impacting customer data, our security team will notify affected customers and Atlassian within seventy-two (72) hours of confirmation.
- Incident notices will detail the nature of the event, affected data scope, mitigation steps executed, and guidance for customers.
3. Vulnerability Reporting & Responsible Disclosure
We welcome vulnerability disclosures from security researchers and customers:
- Email your findings to: security@klarlink.io (or contact support@klarlink.io for general support).
- Include reproduction steps, request/response headers, and proof of concept.
- Allow our engineering team adequate time to investigate and issue a patch prior to public disclosure.
- Submissions are acknowledged within 24 business hours.