MailView security and compliance overview

What MailView does

MailView shows .eml and Outlook .msg email attachments inside Jira and Jira Service Management work items. It is read-only and adds a phishing verdict that is based only on what is in the file.

Data flow

MailView is a Forge Custom UI app. Its manifest declares three user interface modules (the work item panel, the box in the right column, and a Get started page for Jira admins) and one static resource. It declares no backend functions and no remote services.

Where the file is read. In the browser of the person looking at the work item. The app asks Jira for the work item's attachment list (GET /rest/api/3/issue/{key}?fields=attachment) and then for the attachment content (GET /rest/api/3/attachment/content/{id}). It uses Forge's requestJira, which Atlassian documents as running "on behalf of the user who is currently interacting with the app" and with that user's Jira permissions.
What is read. Attachments that are, or could be, emails: .eml, .msg, a lone winmail.dat, a zipped email, and files without a known file type (to check whether they are an email). For the list, the app reads the first 64 KB of an .eml and judges up to the 10 newest emails of up to 2 MB each. Files over 10 MB are not opened.
Where it is rendered. In the same browser. Parsing runs in a Web Worker where the browser allows it, with a 30 second limit. The bytes are kept in browser memory for that page load only.
What leaves the browser. The Jira requests above, which go to your own Jira site. Three usage counters, sent to Atlassian (see What is stored). Nothing else in the code sends data to Dortus or to any third party. Links in an email open in a new tab only when a user clicks one. "Download the original" opens the attachment address on your own Jira site.

Permissions

Manifest entry	Value	What it means
OAuth scope	`read:jira-work`	The only scope. Read access to work items and their attachments. No write scope.
Content security	`styles: unsafe-inline`	Lets the `style="..."` formatting inside emails show. Atlassian blocks policies it considers unsafe unless the app declares them here. No script permission is declared.
External permissions	None	No `permissions.external` section: no external fetch (backend or client), images, fonts, styles, scripts, media or frames.
Remotes, storage	None	No `remotes` and no storage module or storage scope.

In Forge, the external lists in the manifest declare which external sources are allowed in the app's Content Security Policy (for example connect-src and img-src), and backend calls to domains not in the manifest are rejected. The Marketplace listing carries the Runs on Atlassian badge.

What is stored

Email content: nothing. MailView has no app storage and no server, and keeps no copies (privacy policy, section 4.4). It does not use localStorage, sessionStorage, IndexedDB or cookies; the app's tests fail if it touches any of them. The email stays a Jira attachment, under your control, as before.
Retention. None for email content. The privacy policy, section 8: "nothing is retained. Closing the work item is enough."
Usage counters. The privacy policy (section 4.1) states that MailView for Jira keeps three plain counters through Forge metrics: the app loaded with at least one email (mailview.shown), an email was opened (mailview.email-opened), and Copy findings was used (mailview.findings-copied). Each is an increment by one, with no content, file names, work item keys or user names. Atlassian attaches the app's identity and context, and its developer console can filter custom metrics by environment and by site. So Dortus can see these counts per installed site. Atlassian's documentation does not state a retention period for them.
Logs. MailView has no backend functions. It writes no logs or error reports to Atlassian, Dortus or anyone else; the three usage counters above are its only telemetry. In production it also switches the browser console off, so error messages, which could contain part of an email, do not stay in the user's browser. Technical diagnostics are shown only in Dortus's development environment.

Rendering safety

Every email body is cleaned with DOMPurify before it is shown. Removed: script, iframe, frame, object, embed, applet, form and form fields, link, meta, base, svg, math, video, audio, canvas, dialog, image maps, and event handler attributes such as onclick.
Remote images are removed. Only images carried inside the email (cid:, turned into a data: address) and data:image addresses are kept. In CSS, @import is removed and url() pointing outside the email becomes none. Positioning properties are removed, so an email cannot place content over the app.
Links. Only http, https, mailto and tel links keep their address. They open in a new tab with rel="noopener noreferrer".
Isolation. The cleaned email is placed in a nested Shadow DOM, so its styles cannot change the app around it. The app itself runs in the iframe that Forge uses for all Custom UI apps, with iframe permissions and sandbox attributes set by Atlassian.
Limits. 10 MB per file, 2,000 MIME parts per .eml, inline images up to 5 MB, nested emails one level deep, 30 seconds to read a file.
The phishing verdict is a visual aid for the person triaging the email. It reads only the file: no network lookups, no domain reputation or threat intelligence. It is not a security control, can miss things and should not be used as an automated control.

Hosting and data residency

MailView runs on Atlassian Forge. Dortus operates no application server for it (privacy policy, section 4.1).
Atlassian applies the Runs on Atlassian badge automatically to eligible apps. The published criteria include: apps "exclusively use Atlassian-hosted compute and storage", "support data residency that matches data residency provided by the host Atlassian app", and "must not egress data, with the exception of egress for analytics purposes".
MailView stores no email data of its own, so there is no app data to place in a region. The email stays a Jira attachment and is stored wherever your Jira site stores attachments.
Atlassian's documentation does not state in which region the usage counters are kept.

Continuity: if Dortus stops

There is no Dortus server in the path. The installed app does not depend on Dortus being available, and keeps working as installed while Atlassian's platform runs it and your Marketplace license is active. Without an active license, MailView shows "MailView has no active license" instead of the email.
Updates, fixes and support would stop, including any change needed after Atlassian changes its platform.
Your Jira admins can uninstall MailView at any time. There is nothing to clean up, because the app stores nothing. Your attachments are not changed by MailView, which has no write scope.

Support

Support by email at support@dortus.com, in English or Dutch. The support page states a first reply within one business day, Monday to Friday, Europe/Amsterdam. The terms of service (section 7) say we do not offer a formal uptime guarantee.

Vulnerabilities and incidents

These commitments are published on our security page. Reported vulnerabilities are fixed within Atlassian's Marketplace bug fix timelines: critical within 10 days, high within 4 weeks, medium within 12 weeks. If a security incident affects the app, Atlassian is notified within 24 hours through their partner process, and affected customers within 72 hours; the 72 hours is our own commitment. Report security issues to support@dortus.com. Dependencies are pinned to exact versions in the lockfile.

What we do not have

No independent penetration test report or external code audit.
No SOC 2 report and no ISO 27001 certification.
MailView is not Cloud Fortified.
MailView is not in the Atlassian Marketplace Bug Bounty program.
No formal uptime guarantee or SLA.

What the listing does have: one scope (read:jira-work), the Runs on Atlassian badge, a completed privacy and security questionnaire, payment through Atlassian, and Atlassian's Standard license agreement (Atlassian Marketplace Terms).

Security questions

Email support@dortus.com. The Marketplace privacy and security questionnaire is available on the MailView listing.

See also: Privacy policy · Terms of service · MailView