1. Overview
Spreadsheet Lookup Fields for Jira is a Forge app for Jira Cloud. It turns spreadsheet and CSV reference data into Jira and Jira Service Management picker fields, with catalog management handled by Jira administrators.
The app is designed for teams that want controlled Jira field values without vendor-hosted app servers, external data connectors, or customer catalog data leaving the Forge app runtime.
2. Data Storage and Egress
2.1 Where Data Is Stored
- Catalog definitions, source rows, published versions, import state, field links, and publish snapshots are stored in Atlassian-hosted Forge SQL.
- Selected issue field values are stored by Jira.
- Compact search snapshots for JQL are stored in Jira issue properties under the app property key
catalogfield. - Data location, residency, backup, and infrastructure controls follow Atlassian Forge and Jira Cloud platform behavior for the customer's Atlassian site.
2.2 What the App Does Not Do
- No vendor-hosted app servers.
- No Forge Remote.
- No external connectors.
- No manifest-declared external egress.
- No web triggers.
- No external analytics or tracking.
- No AI calls.
- No collection of Atlassian passwords, API tokens, personal access tokens, third-party credentials, or payment card data.
2.3 Activation Metrics
The app uses Atlassian Forge custom metrics counters for high-level setup milestones, such as onboarding opened, example data used, import validated, catalog published, field linked, first value saved, and portal enabled.
These counters do not include catalog values, issue content, spreadsheet rows, names, emails, or other customer-entered catalog data.
3. Access Controls
- Catalog administration is available from a Jira administration page and requires Jira administrator permission.
- Runtime picker reads are tied to a Jira custom field that is actively linked to a catalog.
- Jira-facing picker, workflow post-function, and search-index behavior use published catalog versions. Draft catalog changes do not affect Jira users until an administrator publishes them.
- JQL search-index writes verify Jira issue edit permission before writing the app's issue property.
- Jira Service Management customer portal access is off by default for every catalog. A Jira administrator must explicitly share a catalog with portal customers.
- Sharing picker options and sharing extra row details are separate settings, so a catalog can be selectable on a portal without exposing internal detail columns.
4. Support
For help, bug reports, security/privacy reports, and feature requests, use the public support portal:
https://drinkits.atlassian.net/servicedesk/customer/portal/100
| Severity | Examples | Target first response |
|---|---|---|
| Critical | Production outage, suspected security/privacy incident, or most users cannot save field values. | 1 business day, Monday-Friday, Europe/Riga timezone. |
| High | A core workflow is blocked for one team or project and no reasonable workaround exists. | 2 business days. |
| Normal | Usage question, setup help, non-blocking defect. | 3 business days. |
| Low | Feature request, roadmap question, documentation clarification. | 5 business days. |
These are support response targets, not a separate legal SLA unless a customer agreement states otherwise.
5. Sending Support Data Safely
- Do not send full spreadsheets unless support specifically asks for a small redacted example.
- Do not send Atlassian passwords, API tokens, personal access tokens, or third-party credentials.
- When possible, include the Jira site URL, affected project/request type/screen, catalog name, field name, and steps to reproduce.
- If a screenshot contains sensitive information, redact it before attaching it to the support ticket.
6. Trust Program Limits
The app currently claims Runs on Atlassian eligibility only. It does not currently claim Cloud Fortified, Atlassian Enterprise Certified, SOC 2, ISO 27001, public bug bounty participation, or a public VPAT.
These limits are deliberate. The app should not claim trust programs or certifications until the required external processes, evidence, and operating commitments are actually in place.