Where does a Third Party app "live"?

[Ben Robbins]

This feels like a very stupid question to ask... but first the background:

Currently running through a SaaS questionnaire with a third party application for Jira Cloud and we received the following response to one of the questions:

Q: Which parties have access to data stored or processed within the cloud service?
A: Customer, vendor, and a third party

We queried why the vendor and a third party have access which came back as the app is stored on GCP and the vendor uses Atlassian API to access issue data without which will limit the functionality of the app.

So my actual question: When you add a third party application to a cloud site, what is actually happening in the background? Sounds like nothing is "installed" on the site and instead it's only opening access to an application which lives on another server? As a said, feels a fundamental/silly question but cannot find any clarification in Atlassian documentation on this.

We're only dipping our toes in the cloud pool as our main instance is data center  so obviously we're very used to installing apps directly into our instance.

[Trudy Claspill · Accepted solution]

Hello @Ben Robbins 

The answer is, it depends on the app.

With Jira Cloud vendors are limited in what they can add to the site. They are not granted access to install code on the server where Jira is being hosted. They can only interact with the Jira instance via the API.

So, depending on what functionality they are trying to provide, they may not be able to add the necessary components to the Jira environment directly. Instead they may have to host code on a separate system and pull/push data from/to Jira via the REST API.

[Ben Robbins]

Thanks @Trudy Claspill , yes I should have added that I expect it would depend on the app but I was looking a generic/simple answer to cover it in a general way (which is what you have given me).

[marc -Collabello--Phase Locked-]

Hi @Ben Robbins ,

You are right, when you install an app, the app vendor gets access to your cloud instance through APIs.  The app itself (i.e. the code) is not added to your cloud site.

There are different types of apps:  some run on the app vendors infrastructure (or on behalf of the app vendor in GCP or AWS or ...).  Other apps run directly in Atlassian's infrastructure, however these apps also can connect to the outside and send data to other third parties.

[Nikola Perisic]

Hello @Ben Robbins 

Please post this question here: https://community.developer.atlassian.com/ as this needs more technical expertise to answer it.

[marc -Collabello--Phase Locked-]

That's not the right place, as this is about programming/developing apps.