Sub-processors
This page lists the third parties that Spec2Tickets engages to process customer content on its behalf. It is material only for Managed Processing — the free-trial runs in which Spec2Tickets calls the Anthropic API using its own Anthropic account (on a welcome credit), making Spec2Tickets the processor and the listed party a sub-processor. Once you use your own Anthropic key (BYOK), no Spec2Tickets sub-processor is engaged.
Current sub-processors (Managed Processing)
| Sub-processor | Purpose | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Anthropic PBC (maker of Claude) |
AI inference for the Managed Processing. Receives the Confluence page content the customer submits for a breakdown and returns the generated Jira breakdown (Epic, stories, subtasks, acceptance criteria, and dependencies). | The selected Confluence page content (which may contain customer-controlled personal data, such as names or work emails in free text) and the generated breakdown. | United States (and any additional regions on Anthropic's then-current sub-processor list). |
Anthropic Commercial Terms of Service, with Anthropic's DPA plus EU SCCs (and UK Addendum) incorporated by reference (no separate signature). No training on customer content by default. Message Batches API: not ZDR-eligible, so inputs and outputs are retained for up to about 29 days and then deleted; flagged or abuse-related content may be retained up to about 2 years for legal and safety purposes. Anthropic's own sub-processors, certifications, and change-notice policy are published at trust.anthropic.com. |
Atlassian platform
Spec2Tickets is an Atlassian Forge app. Atlassian provides the hosting platform: it runs the app and stores the app's data within the customer's own Atlassian instance, governed by the customer's existing agreement with Atlassian.
Because app data is stored inside the customer's own instance, Atlassian is not a party to whom we disclose content in the Managed inference flow the way Anthropic is. It is listed here for transparency rather than as a content sub-processor in the usual sense.
How we store and purge content
- Customer content (the submitted page and the generated breakdown) is stored transiently in Atlassian Forge storage within the customer's own instance, only to drive the review-and-push workflow.
- Content is removed when the customer pushes the breakdown to Jira or uninstalls the app; a breakdown that is never pushed, including one the customer regenerates away or leaves unattended, is automatically removed after 7 days of inactivity (opening it for review resets that timer). On the Anthropic side, batch inputs and outputs are deleted within about 29 days (flagged content may be retained up to about 2 years).
- The only external destination for content is Anthropic (the sub-processor above). The app runs no separate vendor backend or database, and Spec2Tickets keeps no copy of customer content on any Spec2Tickets-operated system.
Change-notice policy
- We will give customers at least 30 days' advance notice before adding or replacing a sub-processor for the Managed Processing, by updating this page and/or notifying the customer's designated contact.
- Customers who reasonably object to a new sub-processor on data-protection grounds may raise it with us; if the matter is unresolved, the customer may stop using the Managed Processing for the affected processing (BYOK remains available). See the customer-facing Data Processing Addendum for the full mechanism.
How to subscribe to changes
To receive sub-processor change notices, watch this page, or email privacy@spec2jira.com to be added to sub-processor change notices.