Sub-processors

Last updated: June 4, 2026

This page lists the third parties that Spec2Tickets engages to process customer content on its behalf. It is material only for the Managed tier, where Spec2Tickets calls the Anthropic API using its own Anthropic account — making Spec2Tickets the processor and the listed party a sub-processor.

BYOK engages no Spec2Tickets sub-processor. Under the Bring-Your-Own-Key (BYOK) tier, the customer uses their own Anthropic key, and Anthropic is the customer's own processor under the customer's own agreement. Spec2Tickets engages no sub-processor for BYOK content. Questions: privacy@spec2jira.com · Security: security@spec2jira.com.

Current sub-processors (Managed tier)

Sub-processor	Purpose	Data processed	Location	Safeguards
Anthropic PBC (maker of Claude)	AI inference for the Managed tier. Receives the Confluence page content the customer submits for a breakdown and returns the generated Jira breakdown (Epic, stories, subtasks, acceptance criteria, and dependencies).	The selected Confluence page content (which may contain customer-controlled personal data, such as names or work emails in free text) and the generated breakdown.	United States (and any additional regions on Anthropic's then-current sub-processor list).	Anthropic Commercial Terms of Service, with Anthropic's DPA plus EU SCCs (and UK Addendum) incorporated by reference (no separate signature). No training on customer content by default. Message Batches API: not ZDR-eligible, so inputs and outputs are retained for up to about 29 days and then deleted; flagged or abuse-related content may be retained up to about 2 years for legal and safety purposes. Anthropic's own sub-processors, certifications, and change-notice policy are published at trust.anthropic.com.

No “zero retention.” Because the Managed tier uses the Anthropic Batches API, content is retained at Anthropic for up to about 29 days. We disclose this rather than claim zero retention. Customers who require zero or minimal retention should use the BYOK tier and configure their own Anthropic agreement accordingly.

Atlassian platform

Spec2Tickets is an Atlassian Forge app. Atlassian provides the hosting platform: it runs the app and stores the app's data within the customer's own Atlassian instance, governed by the customer's existing agreement with Atlassian.

Because app data is stored inside the customer's own instance, Atlassian is not a party to whom we disclose content in the Managed inference flow the way Anthropic is. It is listed here for transparency rather than as a content sub-processor in the usual sense.

How we store and purge content

Customer content (the submitted page and the generated breakdown) is stored transiently in Atlassian Forge storage within the customer's own instance, only to drive the review-and-push workflow.
Content is removed when the customer pushes the breakdown to Jira or uninstalls the app; a breakdown that is never pushed — including one the customer regenerates away or leaves unattended — is automatically removed after 7 days of inactivity (opening it for review resets that timer). On the Anthropic side, batch inputs and outputs are deleted within about 29 days (flagged content may be retained up to about 2 years).
The only external destination for content is Anthropic (the sub-processor above). The app runs no separate vendor backend or database, and Spec2Tickets keeps no copy of customer content on any Spec2Tickets-operated system.

Change-notice policy

We will give customers at least 30 days' advance notice before adding or replacing a sub-processor for the Managed tier, by updating this page and/or notifying the customer's designated contact.
Customers who reasonably object to a new sub-processor on data-protection grounds may raise it with us; if the matter is unresolved, the customer may stop using the Managed tier for the affected processing (BYOK remains available). See the customer-facing Data Processing Addendum for the full mechanism.

How to subscribe to changes

To receive sub-processor change notices, watch this page, or email privacy@spec2jira.com to be added to sub-processor change notices.

This list reflects the Managed tier. BYOK uses the customer's own Anthropic key and engages no Spec2Tickets sub-processor for the content sent to Anthropic. The external retention figures above (about 29 days; up to about 2 years for flagged content) are Anthropic's own and reflect Anthropic's published policy at the time of this update.