BesTest Logo
BesTestTest Management for Jira

Data & Security

Last Updated: October 2026

This page describes, in plain language, how BesTest is built, where your data lives, what we store (and deliberately do not store), and how we protect it. It is written to answer the questions security and procurement teams usually ask. BT Studio is a small, focused team: we would rather be transparent about exactly what we do than hide behind vague claims.

1. Architecture: what runs where

BesTest consists of three parts:

  • The app, on Atlassian Forge. BesTest is built on Atlassian's Forge platform. The user interface runs inside your Jira Cloud experience, within Atlassian's security sandbox, and identity comes from your Atlassian account. We never see or handle your Atlassian password.
  • A backend service, on Fly.io. The app calls our backend directly through a Forge remote. Every request carries a short-lived token signed by Atlassian (a Forge Invocation Token), and the backend verifies it before any data is touched. The backend servers run in the same region as your database and do not store customer data.
  • A dedicated database, on Supabase. Your test management data (requirements, test cases, test cycles, execution results) is stored in a PostgreSQL database hosted by Supabase on Amazon Web Services (AWS) in your region. Data is not stored inside your Jira issues, and we do not use Forge storage for customer content.

Because your data is stored on our own backend, BesTest is a Forge app with a remote backend, not a "Runs on Atlassian" app. Cloudflare provides DNS for our domains only: app traffic and app data do not pass through Cloudflare.

2. Where customer data is stored (and could be stored)

Customer data is stored in exactly one region:

  • European Union: database and backend in Frankfurt, Germany
  • United States: database in Oregon, backend in San Jose, California
  • India: database in Mumbai, backend in Singapore

The region follows the data residency location of your Jira site. A site pinned to the United States or India uses that region. Every other site uses the European Union region, including a site with no pinned location. Please contact us before you change the location of a site that already uses BesTest.

Data does not move between regions, and each region has its own database and backend with its own credentials. Additional regions can be provisioned on request. Customer content is only persisted in the database of your region; the backend processes requests in memory and keeps no copy. Our marketing website is hosted separately and stores no customer app data.

3. Data minimization: what we store, and what we refuse to store

We collect the bare minimum needed to run the product. Concretely, our database stores:

  • Your Atlassian site identifier (cloud ID) to know which Jira instance an organization belongs to
  • Pseudonymous Atlassian account identifiers (UUIDs) to attribute work items to users
  • The test management content your team creates: requirements, test cases, steps, cycles, executions, comments
  • References to Jira work items you link (issue IDs and keys only)
  • An audit trail of changes (which account identifier changed an item, and when) and in-app notifications
  • Pseudonymous usage events (an event name and timestamp, for example onboarding progress or a report being opened) and per-organization API usage counts, used to improve the product

We deliberately do not store:

  • End-user names, email addresses, or avatars: names shown in BesTest are resolved live from Jira while you use the app and never persisted by us
  • The content of your Jira issues: we keep only the reference (ID and key)
  • Jira attachments: BesTest does not copy them
  • Atlassian credentials of any kind

4. Security measures

  • Encryption in transit (TLS on every connection; the backend verifies the database certificate) and at rest (AES-256 at Supabase on AWS). Our providers manage the encryption keys; customer-managed keys are not offered
  • Tenant isolation: every database query runs under PostgreSQL Row-Level Security scoped to the requesting organization, enforced on every request, not just in application code
  • Identity: requests from the app carry short-lived tokens signed by Atlassian, which the backend verifies; API tokens for integrations are issued per organization, scoped, and revocable
  • Least privilege: services connect with minimal database roles; production access is limited to the founding team
  • Regional isolation: each hosting region is a separate database and backend with separate credentials
  • Incident notification: if a security incident affects your data, we notify you without undue delay, and no later than 72 hours after we become aware of it
  • No ad tech inside the app: no advertising trackers or third-party profiling in the product

Honesty note: as a small company we do not currently hold formal certifications such as SOC 2 or ISO 27001. We apply the industry-standard practices above, keep our attack surface small, and are happy to walk your security team through the architecture in detail.

5. GDPR compliance

  • For test management content, your organization is the controller and BT Studio acts as a processor; for account, website, and usage data, BT Studio is the controller
  • Processing rests on contract performance (providing the app), legitimate interest (security, operations, and understanding product usage), and consent where required; details in our Privacy Policy
  • The same roles apply under other privacy laws, for example South Africa's POPIA, where your organization is the responsible party and BT Studio is the operator
  • A Data Processing Agreement (DPA) including Standard Contractual Clauses is available on request
  • Uninstalling BesTest does not delete your data automatically. When you ask us in writing, we delete all data of your instance from our systems and confirm the deletion. Before that, you can export your test cases to Excel or CSV, and all of your data through the BesTest REST API
  • BT Studio is established in Hungary (EU); our supervisory authority is the Hungarian NAIH

6. Sub-processors

For the BesTest app itself:

  • Atlassian (Forge platform: app hosting and user interface, within your Jira Cloud)
  • Supabase (managed PostgreSQL database on AWS in your region: EU, US, or India)
  • Fly.io (backend servers in your region; they process requests and store no customer data)
  • Released.so (in-app release notes widget, loaded in your browser; it receives no BesTest content)

Cloudflare provides DNS for our domains and hosts our marketing website. It is not in the path of app traffic and does not process app data.

Our marketing website additionally uses analytics services (listed in the Privacy Policy); these never touch app data.

7. EULA and agreements

  • Our Terms of Service serve as the End User License Agreement (EULA) for BesTest
  • Billing and payment run through the Atlassian Marketplace and are governed by Atlassian's Marketplace Terms of Use
  • Our Privacy Policy covers data handling; a DPA is available on request

8. Regulated industries (including FINMA)

BT Studio is not a financial institution and is not directly subject to supervision by FINMA or similar financial regulators. For customers in regulated industries carrying out outsourcing or vendor due diligence (for example under FINMA guidance for Swiss financial institutions), the facts that usually matter are documented on this page: EU data hosting is available and region-pinned, data is encrypted in transit and at rest, tenants are isolated at the database level, we store a deliberate minimum of personal data (pseudonymous identifiers only), a DPA with SCCs is available, and we delete your data on your request when you leave. We are happy to complete security questionnaires and support your review within the limits of a small team.

9. Contact

Security questions, questionnaires, DPA requests, or anything about this page:

Beard & Tailor Studio Kft. (trading as BT Studio)
Registered in Hungary, European Union
Email: info@btstudio.io