How access and security work
Everything here was verified against the code on 1 September 2026. Where the product does not do something, this says so — a security page that overclaims is worse than no page, because it is the one document a reviewer checks line by line.
The short answer
Easy Reporting uses your Jira permissions. It does not have permissions of its own for Jira data.
There is no user list to maintain, no roles to assign and no per-person settings inside the app. Whoever your Jira administrator says can see a project is who can report on it. Change somebody's access in Jira and their reports change with it.
The two exceptions are files you upload and reports you save. Jira has no opinion about those, so the app manages them, and both start private.
Who you are
Your identity comes from Atlassian, through the Forge platform, on every request. The browser cannot claim to be somebody else: the page never sends an account id, and the app never reads one from a request. If Atlassian does not say who is asking, nothing runs.
Which issues you can see
Asked of Jira, for you, every time you run a report.
The app calls Jira's own permissions endpoint as you — not as itself — and asks which projects you may browse. Permission schemes, project roles, group membership: whatever your administrator configured is what answers. The app keeps no copy of it.
The answer is held for ten seconds so that one click does not become several calls to Jira. In practice a change to somebody's access takes effect in their next report, within ten seconds.
If Jira cannot be asked, the report does not run. It says so and stops. It never falls back to showing everything.
Who can change what the site stores
Turning fields on and off, the storage page, restarting a sync and the site's date format all require the Jira administrator permission, checked against Jira each time. There is no separate app administrator to appoint, and no way to grant app powers to somebody who is not a Jira admin.
Anyone with a Jira licence can build and run reports. What they see in them is scoped to their own access.
Files you upload
Jira has no opinion about a cost-centre map or a team roster, so the app decides this one.
A file is readable by the person who uploaded it, plus the accounts they explicitly name. Nobody else. This is enforced in the database query itself, not by hiding things on screen, and it covers the field list as well as the numbers — somebody without access never learns that a column called "Salary" exists.
Only the uploader can delete a file or change who can read it. Only the uploader can see who it is shared with.
While a file is still loading it is readable by nobody, including the person uploading it. A half-loaded file can produce a wrong number, so it does not become visible until it is complete.
Reports you save
Private to the person who saved them. There is no sharing yet, and no way for an administrator to read somebody else's saved reports.
Where your data lives
Each installation has its own database, on Atlassian's infrastructure, inside your own Atlassian environment. One customer's data is never in the same place as another's.
The app is built without permission to reach any address outside Atlassian, so your data cannot be sent anywhere. There is no analytics service, no external logging and no third-party subprocessor.
Uninstalling drops the database with the app.
What the app does not do
Issue security levels are excluded from reports, for everybody
Jira does not offer a way for an app to ask which issue security levels a particular person belongs to — that information is only available to administrators.
Rather than guess, Easy Reporting leaves every issue that carries a security level out of every report, for everyone.
This is deliberate, and it errs in the safe direction. It also means that if your site uses issue security, some people will not see rows they are entitled to see. If Atlassian publishes a way to ask this question per person, the app will use it and those rows will appear.
Field-level configuration is not applied
Jira lets an administrator hide individual fields from some users through field configuration schemes. Easy Reporting does not know about that.
Project permissions and issue security are honoured. Field-level visibility is not: if somebody can see an issue, they can report on the values of the fields stored for it.
If you hide a field from a group in Jira and that matters, turn the field off in Easy Reporting's storage page so it is not stored at all.
There is a ten-second window
Revoke somebody's access to a project and a report they run in the next ten seconds may still include it. Reports run after that will not.
Comment text is never stored
Only how many comments an issue has. The comments themselves are never read into the database, so they cannot appear in a report.