Security

Architecture overview

LiquidJira uses a multi-tenant control plane: each customer organisation (tenant) can have one or more isolated instances. Each instance has its own database for processed Jira data, so data is separated at the instance level.

Sensitive operations (provisioning, ETL sync, credential handling) run in dedicated backend components with least-privilege access.

Encryption in transit

All communication between your browser and our application uses HTTPS (TLS).

Connections from our platform to Jira Cloud and to PostgreSQL databases use TLS; we do not accept unencrypted database connections in production configurations.

Encryption at rest

Managed databases use encryption at rest provided by Azure Database for PostgreSQL.

Highly sensitive fields (Jira API tokens and database credentials) use envelope encryption: each value is encrypted with a unique data key, and data keys are wrapped using separate master keys (KEKs) in Azure Key Vault — one key domain for Jira credentials and another for database credentials, with component-level permissions enforced in Azure.

Credential handling

Jira API tokens and database passwords are never returned in API responses after storage; the interface shows masked values only.

Plaintext credentials exist only briefly in memory during setup or sync jobs and are discarded after use.

Jira synchronisation is read-only: we fetch data for analytics and do not change your Jira issues.

Authentication and sessions

Users sign in with email and password. Passwords are stored using industry-standard hashing (not in plain text).

The platform issues short-lived access tokens (default 60 minutes) and refresh tokens (default 7 days) with rotation on refresh. The web application stores session tokens in httpOnly cookies, not in browser local storage.

Multi-factor authentication (MFA) and single sign-on (SSO/SAML) are not available for end users in the current release.

Account protection

After 5 consecutive failed sign-in attempts, the account is temporarily locked for 15 minutes (configurable by deployment).

Password reset links are time-limited and sent only to the registered email address.

Authorization

Access is enforced at platform, tenant, and instance levels with role-based membership.

Within an instance, screen-level permissions control which features each user can access.

Infrastructure

The service runs on Microsoft Azure (Container Apps, managed PostgreSQL, Key Vault, Service Bus). Managed deployments target EU regions (West Europe).

Internal service-to-service calls for workers and provisioning use Azure AD application roles where applicable.

Current limitations

We do not currently hold ISO 27001 or SOC 2 certifications; we apply technical controls aligned with common SaaS practice and continue to mature our security programme.

You are responsible for securing your Jira and, if applicable, your own database when using bring-your-own-database options.

Reporting security issues

If you believe you have found a vulnerability, contact info@ohtic.com with the subject line "LiquidJira security" and a description sufficient for us to reproduce the issue. Please do not disclose issues publicly before we have had a reasonable opportunity to respond.