Advanced Reports — Data Handling FAQ (Advanced / MotherDuck tier)
Where is my data stored?
The Advanced tier syncs your selected Jira data into MotherDuck, a managed cloud DuckDB service running on AWS in the eu-central-1 (Frankfurt, EU) region. The Basic tier stores nothing in the cloud: queries run entirely in your browser using DuckDB-WASM, and your data never leaves your device.
Is my data isolated from other customers?
Yes. Each Jira installation is provisioned its own dedicated MotherDuck service account and database, isolated per customer. One customer's credentials cannot access another's data. Provisioning is automatic, and the access token is stored using Forge's encrypted secret storage, never in plain config.
What data is synced, and can I control it?
You control both dimensions:
- Spaces — you select which Jira spaces (formerly "projects") to include in the sync.
- Fields — you select which work-item fields to sync.
All selected fields are synced for all selected spaces. Nothing outside that scope is exported.
The available fields are documented in the SQL field reference. The exact set varies per organization, because custom fields differ from one Jira instance to another.
Who can query the data, and what can they see?
Only authenticated users of your Jira instance, through the app. Access to the cloud database is gated by the per-install service-account token, which the app holds server-side — end users never see or handle credentials.
In addition, work-item access enforces per-row security: a user can only query work items from spaces they have access to in Jira. Data from a space a user can't see is not returned to them, even within the shared Advanced database.
How does data get there — and is the connection secure?
Sync runs from Atlassian Forge background functions (no external Connect server). SQL is sent to MotherDuck over HTTPS through an authenticated proxy (API-key protected). Real-time changes (issue created/updated/deleted) sync via Forge event triggers; bulk sync runs on a schedule.
What happens to my data if I uninstall?
When the app is uninstalled, Forge fires the pre-uninstall lifecycle event (opens in a new tab), which initiates a purge of your data from MotherDuck right away — the customer database and synced work items are deleted, and the stored service-account token is removed.
Data residency / compliance
- Residency: All Advanced-tier data is stored in the EU (AWS
eu-central-1, Frankfurt), supporting EU data-residency requirements. - MotherDuck (the cloud database provider):
- SOC 2 Type II attested. Reports available to customers on MotherDuck's Business Plan via their account team.
- GDPR verified (by GDPR Local); a signed Data Processing Agreement is available from MotherDuck.
- Encryption at rest and in transit using industry-standard encryption; Intrusion Detection System (IDS) monitoring.
- Annual third-party penetration testing, secure SDLC, and OWASP-aligned vulnerability management.
- Operates strictly as a data processor — does not sell, share, or export customer data to third parties; sub-processors are vetted against MotherDuck's security standards.
- Regular backups plus a tested Business Continuity / Disaster Recovery policy.
- Infrastructure hosted on AWS, inheriting AWS's security and privacy certifications.
- Forge components: The Forge-hosted parts of the app inherit Atlassian Cloud's compliance posture (SOC 2 / SOC 3, ISO 27001, GDPR).
Does the Basic tier touch the cloud at all?
No. Basic is 100% in-browser — the strongest privacy story on the market for teams who can't or won't egress Jira data. You can run the app entirely in Basic mode and never provision a cloud database.
How is this different from connectors that export to Power BI / a warehouse?
Those tools push your data into a system you must secure and license. Advanced Reports manages an isolated, per-customer store for you — and, unlike Atlassian Analytics, doesn't require a Cloud Enterprise edition upgrade to get data-lake-scale analytics.