Ledgerman
Ledgerman Trust Centre
Where your financial data lives, and who can see it
Ledgerman runs on Atlassian. Your budgets, contracts and acceptance certificates stay in your Atlassian site, in your site's region, and no data leaves Atlassian. This page gives the facts a security or privacy review asks for.
Last reviewed 5 November 2026, for Ledgerman 2.7.0.
| Vendor | Sideshore OÜ, registry code 14648986, Neeme põik 3, 11711 Tallinn, Estonia (EU) |
|---|---|
| Platform | Atlassian Forge, Jira Cloud only. Eligible for Runs on Atlassian |
| Where data is stored | Forge SQL, Atlassian-hosted storage tied to your Jira site, and your Jira site itself |
| Data residency | Supported. Data is kept in your Jira site's location and moves with it |
| Data sent outside Atlassian | None. The app has no permission to contact other servers |
| Servers run by Sideshore | None. Sideshore holds no copy of your data |
| Sub-processors | Atlassian only |
| Personal data the app records | Atlassian account IDs in the audit log, plus whatever your users type into free-text and vendor contact fields |
| Analytics, tracking, cookies in the app | None |
| Access control | Ledgerman's own Jira permissions, granted in permission schemes and checked on the server for every request |
| After uninstalling | Atlassian keeps the data for 28 days, then deletes it |
| GDPR roles | Your organisation is the controller; Sideshore is a processor where it handles personal data for you. DPA on request |
| Certifications | Sideshore holds none of its own. The app and its data run on Atlassian's infrastructure, covered by Atlassian's compliance programme |
How it fits together
Ledgerman is a Forge app. Its code runs on Atlassian's cloud, and its data sits in Atlassian-hosted storage that belongs to your Jira site. When someone opens Ledgerman, Jira loads the app's pages from Atlassian. The app reads and writes Jira as that person.
Your browser
Jira, with Ledgerman's tabs and pages
↔ Atlassian only
Atlassian cloud · your site's region
JiraProjects and issues. Contract, certificate and vendor issues if you use them
LedgermanForge functions. Check permissions, calculate, validate↔ Jira as the signed-in user
Forge SQLBudgets, contracts, certificates, vendors, settings, audit log
Sideshore receives no financial data. It sees only error logs (no saved data, kept 30 days) and the support requests you send.
- Every page, script and font of the app is bundled with it. Nothing is loaded from other hosts.
- The app has no external fetch permission and no remote back end, which is what qualifies it for Runs on Atlassian.
What is stored
| Data | What it holds | Where |
|---|---|---|
| Settings | Currency, covered years, VAT default, the month books are closed through, the Jira projects and issue types used for contracts, certificates and vendors | Forge SQL |
| Tracked projects | Jira project ID, key and name | Forge SQL, and a marker on the Jira project |
| Budgets | Project, year, 12 monthly amounts, optional category lines | Forge SQL |
| Contracts | Number, vendor, subject, dates, value, currency, VAT flag, annual phasing, linked Jira issue | Forge SQL, and a marker on the linked issue |
| Acceptance certificates | Number, date, amount, period label, comment, VAT flag, linked Jira issue | Forge SQL, and a marker on the linked issue |
| Vendors | Name, registry code, VAT number, country, contact, notes, linked Jira issue | Forge SQL, and a marker on the linked issue |
| Audit log | Time, the Atlassian account ID of the person, the record, its values before and after | Forge SQL |
| Error logs | The error and the operation that failed. Never the data being saved, though they may name a contract number or issue key | Forge logs (Atlassian) |
Ledgerman sends no analytics, uses no cookies, shares nothing with third parties and makes no automated decisions about people.
Who can see what
Access is managed in Jira, by your Jira administrators. Ledgerman adds its own permissions to Jira, and checks them on the server for every request, together with Jira's Browse projects permission.
| Permission in Jira | Kind | Allows |
|---|---|---|
| Ledgerman: View project financials | Project | See a project's budget, contracts and certificates |
| Ledgerman: Edit budget | Project | Change the project's budget |
| Ledgerman: Edit contracts | Project | Add and change contracts |
| Ledgerman: Record acceptance certificates | Project | Add and change certificates. Kept apart from contracts, for segregation of duties |
| Ledgerman: Change closed periods | Project | Change budget amounts, certificates and contract allocations in closed periods |
| Ledgerman: View portfolio | Global | Open the portfolio pages, showing only projects the person may view |
| Ledgerman: Manage vendors | Global | Change the vendor register |
| Ledgerman: Manage categories | Global | Change budget categories |
- The Settings and Import & Export tabs are for Jira administrators only.
- Ledgerman calls Jira as the signed-in person, so it can never read or change anything in Jira that person couldn't.
- Every change goes into the audit log with its old and new values. Entries can't be edited or deleted in the app.
- Once the books are closed through a month, its amounts are locked for everyone without "Change closed periods".
Jira permissions the app asks for
Ledgerman requests five Jira scopes, the minimum its features need.
| Scope | What Ledgerman does with it |
|---|---|
read:jira-work | Checks permissions before showing or changing anything; lists projects and issue types for setup; reads the issues it links to, to show their status; reads permission schemes for the administrators' Permissions view. |
write:jira-work | Creates a Jira issue for a new contract, certificate or vendor when an administrator has chosen a project for them, and marks linked issues so they show the Ledgerman tab. It doesn't edit or delete your issues. |
write:project.property:jira | Marks a project as tracked so it gets the Financials tab. Used instead of a broader scope that could change project settings. |
delete:project.property:jira | Removes that mark when a project is no longer tracked. The project's financial data is kept. |
read:jira-user | Shows people's display names on the Audit tab. Names are looked up when the tab opens and never stored. |
What Sideshore can see
- Error logs. Atlassian shows us the app's error logs for 30 days so we can fix problems. They never contain the data being saved. Your organisation's administrator can turn off our log access in Atlassian Administration.
- Support requests. What you send through the support portal, kept for up to 24 months after the request is closed. You can ask us to delete it sooner.
- Licensing details from Atlassian. The site, the licence and a technical or billing contact, used for licensing and support.
We don't access the stored financial data in normal operation, and we hold no copy of it.
Data residency
Ledgerman supports data residency. Forge SQL keeps the app's data in the same location as your Jira site, and moves it when an administrator moves the site's data to another location.
- In scope: everything Ledgerman stores in Forge SQL: settings, tracked projects, budgets, contracts, certificates, vendors and the audit log.
- Covered by Jira instead: the Jira issues Ledgerman creates or links, and the markers on projects and issues. They follow Jira's own data residency.
- Not covered: Atlassian's Forge error logs.
Retention and deletion
- While installed: data stays until people with the right permissions edit or delete it. The audit log is never deleted in the app.
- If the subscription lapses: nothing is deleted. Ledgerman becomes read-only until the subscription is renewed.
- Before uninstalling: a Jira administrator can export every tracked project's budgets, contracts and certificates to Excel, in the layout the import reads, and the audit log to CSV.
- After uninstalling: Atlassian keeps the app's data for 28 days, then deletes it. A reinstall starts empty. To get the earlier data back, contact us within 21 days of uninstalling, and with your consent we ask Atlassian to re-link it.
- In Jira: issues Ledgerman created stay in Jira after uninstalling, until you delete them there.
Personal data and GDPR
- Your organisation decides what is entered in Ledgerman and is the controller of that data.
- Where Sideshore handles personal data for you, for example in an error log or a support request, it acts as a processor under GDPR Article 28. Atlassian is the only sub-processor.
- A Data Processing Agreement is available on request through the support portal.
- The only personal data the app records by itself is the Atlassian account ID of whoever made a change. Vendor contact fields and comments hold whatever your users type.
- Ledgerman doesn't remove account IDs of closed Atlassian accounts from the audit log automatically. Ask through the support portal and we'll help your organisation do it.
- The supervisory authority for Sideshore is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
Security reviews
Reviewing Ledgerman for your organisation? Send your security questionnaire or DPA request through the support portal. The fact sheet at the top of this page and the Security, privacy and data residency page in the documentation answer most questions directly.
Report a security issue
If you find a vulnerability in Ledgerman, tell us privately at go@sideshore.tech or through the support portal, with the steps to reproduce it. We confirm receipt within one business day and keep you informed until it is fixed. Please don't test against other customers' sites or data.
Machine-readable contact: /.well-known/security.txt