VIVID INSIGHTSecurity, Data Handling, and Current Release Scope
Learn which data Vivid Connector processes, how the temporary previous-app import is protected, why Jira permissions are required, and which historical features are unavailable.
- Last verified
- Product
- Vivid Connector
Access model
Vivid Connector runs as an Atlassian Forge app in Jira Cloud and communicates with the Telegram Bot API at api.telegram.org. While the temporary previous-app import is available, the Forge backend also makes read-only migration requests to jtn.ronhul.xyz. Configuration takes place on a Jira administration page. The organization uses its own Telegram bot and controls the chats that bot can access.
Before enabling notifications, an administrator must confirm that the membership of each Telegram chat is appropriate for the sensitivity of the selected Jira projects. After a message is delivered to Telegram, it is available to chat participants according to Telegram's chat settings and retention behavior.
Jira permissions requested by the app
read:jira-work— read issues, fields, projects, comments, and other data required for filters and messages;read:jira-user— resolve display names for assignees, reporters, actors, and user-picker custom fields;write:jira-work— declared in the current manifest, although the user flows documented here do not create Jira comments from Telegram;storage:app— store the secret, channel configuration, and technical delivery state.
Data stored by the app
Data | Purpose and storage |
|---|---|
Telegram bot token | Forge secret storage. The usable token is never returned to the UI. |
Bot name and username, webhook metadata | Forge KVS for status display and webhook maintenance. |
Temporary verification code and status | Forge KVS. The code is valid for five minutes, and the outcome is retained temporarily for the setup wizard. |
Chat ID, type, name, username, description, member count, and status | Forge SQL for channel management and availability checks. |
Project keys, event types, ticket-parsing setting, and filter expression | Forge SQL as the configuration for a specific channel. |
Fingerprint, issue key, event type, status, attempts, and error | Forge SQL for duplicate prevention and technical delivery state. Expired rows are cleaned up incrementally. |
Ten latest event outcomes | Compact technical history used by Recent activity. |
Current Jira base URL | Sent by the Forge backend to the previous-app service only to find the matching tenant. The browser cannot supply a different URL. |
Previous-app channel, parsing-group, project, event, and filter settings | Read from the previous-app service for preview and Telegram checks. Selected supported settings are stored in Forge SQL only after an administrator confirms import. |
The generated notification text passes through a Forge asynchronous queue and is sent to Telegram. Jira fields included in the message may then be retained by Telegram according to the chat configuration and Telegram policies.
Token and content protection
The token is validated with Telegram before storage.
The UI displays only a masked token value.
Jira values are escaped before they are inserted into Telegram HTML.
The Telegram webhook handler does not include the complete incoming message text or bot token in its diagnostic records.
Each outgoing logical event receives a unique fingerprint to prevent duplicate messages when Forge redelivers an event.
Customer bot configuration and its bot token are scoped to the app installation. The temporary migration-authentication secret is shared by the app's Forge environment across installations and is used only by backend code.
Previous-app requests are signed by the Forge backend with HMAC-SHA256, a timestamp, and a one-time nonce. The shared migration secret is encrypted as a Forge environment variable and is never returned to the browser.
Import resolvers derive the Jira base URL themselves, verify Jira administrator permission, reload legacy data before writing, and accept only selected candidate identifiers from the browser.
Complete legal terms for data processing and retention must be published in the Privacy Policy. This page is an operational description, not a replacement for the privacy policy or a Data Processing Agreement.
Current Forge Edition boundaries
Historical Vivid Connector documentation and the product specification may mention additional capabilities. They are not available through the current manifest, admin UI, and active runtime paths:
Capability | Current status |
|---|---|
Link a personal Telegram account to Jira | Unavailable. The current app has no user page or working account-linking flow. |
Personal direct messages for assignees or watchers | Unavailable. |
Daily due-date reminders | Unavailable. The current release does not run a reminder schedule, and obsolete settings are removed during data-structure updates. |
Create Jira comments from a Telegram discussion group | Unavailable. The current release does not map discussion groups to issues or process replies as comments. |
Edit and preview notification templates | Not published in the UI. Current messages use built-in layouts. |
Manage ticket parsing through a separate parse-chat list | Replaced by a setting in each connected group or supergroup. |
Import supported settings from the previous app | Temporarily available after the Forge bot is connected. The import is read-only until an administrator confirms selected channels and does not overwrite existing Forge rows. |
Use ticket parsing in private chats or channels | Unavailable. Only groups and supergroups are supported. |
Do not use descriptions of the historical connector as evidence that a feature exists in Forge Edition. Use the current Jira administration interface and this documentation.
Recommendations for administrators
Create a dedicated bot for each Jira installation and environment.
Grant the minimum Telegram permissions required: posting for channels and ordinary-message access only where ticket parsing is needed.
Restrict channels to Jira projects before adding advanced filters.
Review Telegram chat membership regularly.
Revoke the token with @BotFather when ownership changes or exposure is suspected.
Do not place secrets or personal data in filter examples, test messages, or screenshots.
Review every previous-app import warning and final report; configure a blocked channel manually rather than weakening its old filter.