1. Introduction

 

Riffle Resilience Inc. ("Riffle," "we," "us," or "our") is committed to protecting the privacy, confidentiality, and security of information entrusted to us by our customers, website visitors, and business partners.

Riffle provides operational resilience and business continuity software built on the Atlassian Cloud platform, as well as related professional services.

This Privacy Policy describes how we collect, use, process, store, share, and protect information in connection with:

• Our website, www.riffleresilience.com;

• Riffle Operational Resilience, our Atlassian Marketplace application;

• Riffle Data Sync for JSM Cloud (Integration for ServiceNow®), our Atlassian Marketplace integration application; and

• Related sales, marketing, customer support, and business communications.

Our applications are designed to operate within Atlassian's cloud ecosystem. Customer application data is stored using Atlassian-managed infrastructure, rather than separate Riffle-operated servers or databases.

This Policy also explains the limited circumstances in which information may be processed by third-party services, including product analytics, website services, and customer-authorized integrations.

By using our website or services, you acknowledge the data practices described in this Policy. Where consent is required by applicable law, we will seek that consent separately.

​

2. Our Role in Processing Personal Information

Riffle may act as either a Data Controller or Data Processor, depending on the nature and purpose of the information being processed.

​

2.1 Riffle as a Data Processor
When organizations use Riffle's Atlassian Marketplace applications to create, manage, or analyze business continuity and operational resilience information, the customer generally acts as the Data Controller, and Riffle acts as a Data Processor or service provider, as applicable under relevant privacy laws.

In this capacity:

• Customers determine what information is entered into the applications and for what business purposes.

• Customers retain control over their application content, subject to applicable contractual terms.

• Riffle processes information only as necessary to provide the authorized services or in accordance with applicable customer instructions.

• Application access is governed by the customer's Atlassian environment, permissions, and administrative controls.

• Riffle does not independently use customer business continuity content for advertising, marketing, or unrelated commercial purposes.

Processing of customer-controlled personal information may also be governed by a separate Data Processing Agreement (DPA).

 

2.2 Riffle as a Data Controller
Riffle acts as an independent Data Controller when it determines the purposes and means of processing personal information for its own business operations.

Examples include:

• Website visitor information and website analytics;

• Sales inquiries, demo requests, and prospective customer communications;

• Marketing subscriptions and business contact information;

• Customer relationship management;

• Support correspondence and service administration;

• Limited product usage analytics collected for product improvement; and

• Business, contractual, and administrative records.

In these circumstances, Riffle processes information in accordance with this Privacy Policy and applicable data protection laws.

 

3. Information We Collect and Process
The information processed by Riffle depends on how individuals and organizations interact with our website, applications, and services.

 

3.1 Website and Business Contact Information
When you visit our website, contact us, request a demonstration, or communicate with our team, we may collect:

• Name and professional title;

• Business email address and telephone number;

• Company or organization name;

• Information submitted through contact forms;

• Product interests and sales inquiries;

• Communication history and correspondence;

• Website usage and interaction information; and

• Device, browser, IP address, and other technical information.

We use Wix Analytics and HubSpot to support website analytics, customer relationship management, communications, and marketing activities.

 

3.2 Customer Application Data
Customers may enter, import, or manage information through Riffle's operational resilience applications, including:

• Business processes and value streams;

• Information technology systems and other organizational assets;

• Operational dependencies and relationships;

• Business impact analyses and risk assessments;

• Business continuity and disaster recovery plans;

• Recovery strategies, procedures, and restoration sequences;

• Employee, vendor, and emergency contact information;

• Organizational locations, departments, and operational responsibilities;

• Supporting documents, templates, and attachments; and

• Other customer-created resilience planning information.

This information is referred to in this Policy as "Customer Application Data."

Customer Application Data is stored within Atlassian-managed infrastructure. Riffle does not maintain independent copies in Riffle-operated external databases, servers, or cloud storage.

 

3.3 Atlassian Account and User Information
Our applications may access limited Atlassian account and organizational information necessary to provide authorized functionality, such as:

• Atlassian user identifiers;

• User names and business email addresses;

• Jira site identifiers and hostnames;

• Organizational and permission information; and

• Application configuration and access settings.

Access to this information is governed by the permissions and scopes authorized through the Atlassian platform.
Riffle does not independently collect or store users' Atlassian account passwords.

 

3.4 Integration Data
Where a customer enables an integration, such as Riffle Data Sync for JSM Cloud, the application may process information from customer-authorized systems.

This may include:

• ServiceNow Configuration Item records;

• Asset attributes and identifiers;

• Configuration and dependency relationships;

• Synchronization settings and status information;

• Integration configuration and connection information; and

• Technical information needed to complete and monitor synchronization.

Integration data is processed for the specific synchronization or integration functionality authorized by the customer.

Connection credentials and application configuration requiring persistent storage are maintained using Atlassian Forge-hosted storage and secret-management capabilities, as applicable.

Riffle does not maintain an independent external database containing synchronized customer records or integration credentials.

 

3.5 Product Usage Analytics
Riffle uses PostHog to understand application usage, identify technical issues, and improve product functionality.

The analytics information collected by the core Riffle application is limited to pseudonymous usage events and technical metadata. This may include feature interactions, application activity, technical event information, and the associated Jira site hostname.

Product analytics does not include the contents of customer-created assets, business impact analyses, business continuity plans, recovery procedures, dependency records, or other customer-entered application content.

PostHog processes this limited analytics information in the United States, separately from Atlassian-hosted Customer Application Data.

Jira administrators may disable Riffle product analytics through the application's administrative settings.

Pseudonymous information may still constitute personal information under applicable privacy laws when it can be associated with an identifiable person or organization.

 

4. How We Use Information
We process information for legitimate, defined business and operational purposes, including:

Providing our applications and services: Enabling customers to create, maintain, analyze, and export business continuity and operational resilience information.
Operating integrations: Synchronizing information between customer-authorized systems and Atlassian applications.
Customer support: Responding to questions, investigating technical issues, and providing customer-authorized assistance.
Application security and reliability: Detecting technical problems, preventing unauthorized activity, and maintaining the security and performance of our products.
Product improvement: Analyzing limited usage and technical information to understand how features are used and identify opportunities for improvement.
Business communications: Responding to prospective customers, scheduling demonstrations, and communicating about products and services.
Marketing: Providing information about Riffle products, services, events, and developments in accordance with applicable law and communication preferences.
Legal and contractual obligations: Maintaining records and responding to lawful requests or obligations.

We do not use Customer Application Data for third-party advertising, sell Customer Application Data, or independently use customer-controlled information for purposes unrelated to delivering authorized services.

 

5. Atlassian Cloud Hosting and Data Storage
Riffle's Atlassian Marketplace applications are built using Atlassian Forge and operate within Atlassian's cloud ecosystem.

The core Riffle application uses Atlassian-hosted persistent storage capabilities, including:

• Forge SQL;

• Forge Object Store; and

• Forge Key-Value Store.

These services allow application information to be stored within Atlassian-managed infrastructure associated with the customer's application installation.

Riffle does not operate separate hosting infrastructure for the storage of Customer Application Data.
Atlassian provides the underlying cloud infrastructure and platform-level controls. Riffle remains responsible for the security of the application functionality and code it develops, including appropriate permissions, secure development practices, and application-level controls.

Customers should refer to Atlassian's applicable security, privacy, and cloud service documentation for additional information about the underlying platform.

 

6. Data Residency
Riffle supports Atlassian Forge's data residency capabilities for in-scope Customer Application Data.

 

6.1 In-Scope Data
Data stored in the core Riffle application's Forge-hosted persistent storage is eligible for Atlassian's PINNED data residency status.

This includes customer-created application information such as:

• Value streams and process records;

• Asset and dependency records;

• Assessments and recovery plans;

• Operational resilience planning information;

• Stored documents and related application content; and

• Other in-scope data maintained in Forge-hosted storage.

The Riffle Data Sync application similarly uses Atlassian-hosted storage for its applicable configuration, connection, and synchronization information.

​

6.2 Regional Hosting
When a customer's supported Atlassian site is pinned to a particular data residency region, eligible Forge-hosted application data is hosted in the corresponding region and may appear as PINNED in Atlassian Administration.
If the customer initiates a supported regional migration, Atlassian manages migration of eligible Forge-hosted data in accordance with its data residency processes.
The availability of specific regions and administrative options is determined by Atlassian.

 

6.3 Information Outside the Data Residency Boundary
Certain limited information is not covered by Riffle's Forge-hosted data residency commitments.

Specifically:

• Pseudonymous product usage events and the Jira site hostname may be transmitted to PostHog for processing in the United States.

• Customer-authorized integrations may exchange information with external systems designated by the customer, including ServiceNow.

• Atlassian Rovo and other Atlassian-managed services may process information under their own applicable service, AI, and data residency arrangements.

These activities do not involve Riffle maintaining an independent external repository of Customer Application Data.
The use of PostHog analytics is optional at the customer administration level and may be disabled by a Jira administrator.

 

7. Artificial Intelligence and Atlassian Rovo
Riffle may provide AI-assisted functionality through Atlassian Rovo.

Riffle relies on Atlassian Rovo for these capabilities and does not independently transmit customer prompts or Customer Application Data to a separately contracted generative AI provider for Riffle's own model processing.

When users interact with Rovo-enabled features, relevant prompts, authorized contextual information, and generated responses may be processed through Atlassian's AI services.

Atlassian may use Atlassian-hosted models or third-party AI model providers to fulfill requests, subject to Atlassian's applicable contractual, security, privacy, and AI data-handling commitments.

According to Atlassian's published AI practices, third-party AI providers are not permitted to retain customer inputs and outputs or use them to train or improve their own models.

Atlassian may separately process certain metadata under its published data contribution settings and privacy practices.

Riffle does not independently use Customer Application Data to train proprietary or third-party generative AI models.

Customers should review Atlassian's AI Trust documentation and available administrative settings for additional information about AI data processing and controls.

 

8. Product Analytics and PostHog
Riffle uses PostHog as a product analytics provider for the core Riffle application.
This service helps us understand product adoption, feature usage, and technical performance.
The information transmitted to PostHog is limited to pseudonymous usage events, technical metadata, and the associated Jira site hostname.
Riffle does not intentionally send the contents of customer-created continuity plans, asset records, impact assessments, recovery procedures, or other application documents to PostHog.
PostHog analytics information is processed in the United States and is outside the residency scope of Atlassian Forge-hosted Customer Application Data.
Product analytics information is used for internal product operations and improvement, not to sell customer information or advertise third-party products.
Jira administrators can disable this analytics collection through the application's administrative settings.

 

9. Website Cookies and Tracking Technologies
Our website may use cookies and similar technologies to support essential website functionality, understand visitor activity, and improve the visitor experience.
We currently use:
Wix Analytics: To support website performance monitoring, usage reporting, and visitor analytics.
HubSpot: To support customer relationship management, contact forms, marketing communications, and related visitor interactions.
Depending on the services and settings in use, these technologies may process information such as device identifiers, IP addresses, page visits, referral information, and website interactions.
Where required by applicable law, non-essential tracking technologies will be subject to appropriate notice and consent mechanisms.
Visitors may manage cookies through available website privacy controls and their browser settings. Disabling certain cookies may affect website functionality.
Information collected through our website is separate from Customer Application Data stored within Atlassian Forge.

​

10. How We Share Information
Riffle does not sell personal information or Customer Application Data.
We may disclose limited information to third parties where necessary to provide services, fulfill legitimate business purposes, comply with legal obligations, or carry out customer-authorized activities.
These parties may include:
Atlassian: Provides the underlying application platform, hosting, identity services, and related cloud infrastructure for our Marketplace applications.
PostHog: Processes limited product usage analytics and technical metadata.
Wix: Provides website services and analytics.
HubSpot: Supports customer relationship management, contact forms, and marketing communications.
Customer-authorized integration providers: Systems such as ServiceNow, where customers configure integrations and authorize the exchange of information.
Professional and operational service providers: Authorized providers assisting with legal, accounting, communications, or other legitimate business operations, where necessary.
Public authorities: Where disclosure is required by applicable law, valid legal process, or other legally permitted circumstances.
We may also disclose information in connection with a corporate transaction, such as a merger or acquisition, subject to applicable confidentiality and data protection requirements.
Service providers processing personal information on our behalf are subject to appropriate contractual and data protection obligations where required.

 

11. Customer Control and Authorized Access
Customers retain administrative control over their Riffle applications through their Atlassian environments.
Customer administrators are responsible for assigning authorized users, maintaining appropriate permissions, and determining the information made available within their organization's applications.
Riffle personnel do not routinely access customer-created application information.
Access by Riffle employees or authorized contractors is limited to circumstances such as:

• Customer-requested technical troubleshooting;

• Customer-authorized support activities;

• Temporary access specifically approved by the customer; or

• Other access expressly authorized by the customer or required by applicable law.

Such access is limited to authorized purposes and is subject to appropriate confidentiality and security controls.
Riffle does not use administrative or support access to independently collect, analyze, or reuse customer business continuity content for unrelated purposes.

 

12. Information Security
Riffle maintains technical and organizational security practices designed to protect information against unauthorized access, misuse, disclosure, alteration, and loss.
These measures include, as applicable:

• Least-privilege access controls;

• Appropriate authentication and access management;

• Encryption and secure communications;

• Secure application development practices;

• Protection of integration credentials and secrets;

• Confidentiality obligations for authorized personnel;

• Security incident response procedures;

• Vulnerability and change management; and

• Periodic review of security practices.

Our Atlassian Forge applications also benefit from the security controls provided by Atlassian's underlying cloud infrastructure.
No electronic system or communication method can be guaranteed completely secure. Riffle continually evaluates its security responsibilities in accordance with the nature of its services and applicable requirements.

 

Security Incidents
Riffle maintains procedures for identifying, assessing, responding to, and reporting security incidents.
Where Riffle becomes aware of a personal data breach affecting customer-controlled personal information, we will notify the affected customer without undue delay and in accordance with applicable contractual and legal obligations.
Where our applicable Data Processing Agreement requires notification within 48 hours of becoming aware of such a breach, Riffle will follow that commitment.

 

13. Data Retention, Export, and Deletion

​

13.1 Customer Application Data
Customer Application Data remains within Atlassian-managed infrastructure during the applicable application's installation and use.
Riffle provides functionality for customers to export their application information, including relevant plans and records, subject to the capabilities of the applicable application.
Customers should export any information they wish to preserve before uninstalling the application.
When a customer uninstalls a Forge application, its Forge-hosted application data becomes subject to Atlassian's data retention and deletion lifecycle.
Atlassian currently documents a 28-day post-uninstallation retention period for Forge-hosted storage, during which data may be recoverable through Atlassian's supported recovery process. Following the applicable retention period, deletion is handled by Atlassian in accordance with its platform policies.
Riffle does not retain independent copies of Customer Application Data in Riffle-operated infrastructure after uninstallation.
 

13.2 Product Analytics and Business Records
Limited product analytics transmitted to PostHog are maintained separately from Forge-hosted Customer Application Data and are subject to applicable retention and deletion practices.
Website inquiries, support correspondence, commercial communications, and other business records may also be retained separately for as long as necessary for the purposes described in this Policy, including legitimate business and legal requirements.
These separate records do not include independent copies of customer-created business continuity plans, recovery documents, or other Customer Application Data.

 

13.3 Deletion Requests
Requests relating to information controlled by a customer organization should generally be directed to that organization.
Requests relating to information for which Riffle is the Data Controller may be submitted to privacy@riffleresilience.com.
We will evaluate and respond to such requests in accordance with applicable law and our retention obligations.

 

14. Legal Bases for Processing
Where applicable data protection laws require a lawful basis for processing personal information, including under the EU GDPR and UK GDPR, Riffle relies on one or more of the following:
Contractual necessity: Processing required to provide contracted products and services or take requested steps before entering into a contract.
Legitimate interests: Processing reasonably necessary to maintain security, improve products, administer business relationships, and conduct legitimate business operations, subject to applicable balancing requirements.
Legal obligations: Processing required to comply with applicable laws, regulations, and legal processes.
Consent: Processing based on an individual's consent, including for certain marketing communications or non-essential tracking technologies where required.
Where Riffle acts as a Data Processor, the customer is generally responsible for establishing the appropriate lawful basis for its collection and use of personal information and providing the required notices to individuals.

 

15. Privacy Rights
Depending on your location and applicable privacy laws, you may have rights relating to your personal information.
These may include the right to:

• Request access to your personal information;

• Request correction of inaccurate information;

• Request deletion of personal information;

• Request restriction of certain processing activities;

• Object to certain processing;

• Request portability of eligible personal information;

• Withdraw consent where processing is based on consent; and

• Submit a complaint to an applicable data protection authority.

Residents of certain U.S. states, including California, may have additional rights under applicable state privacy laws, such as rights to know, correct, delete, or opt out of certain uses or disclosures of personal information, where applicable.
Riffle does not sell personal information.
To exercise applicable privacy rights regarding information controlled by Riffle, contact privacy@riffleresilience.com.
We may need to verify your identity or authority before fulfilling a request and will respond within the timeframe required by applicable law.
If your request concerns information entered into Riffle by your employer or another customer organization, please contact that organization's privacy officer or administrator. Riffle will provide reasonable assistance to the customer where required under applicable law or contractual obligations.

 

16. International Data Transfers
Riffle serves customers and business partners in multiple jurisdictions.
Customer Application Data stored within Atlassian Forge is subject to Atlassian's applicable data residency configuration and hosting arrangements.
Other personal information, including website information, business communications, and limited product analytics, may be processed in the United States or other jurisdictions in which relevant service providers operate.
In particular, Riffle's PostHog product analytics are processed in the United States.
Where applicable law requires safeguards for international transfers of personal information, Riffle will use appropriate legal mechanisms, which may include recognized adequacy arrangements, Standard Contractual Clauses, or other legally permitted safeguards.
Customers should review applicable Atlassian documentation for details of Atlassian's own international data processing and transfer practices.

 

17. Sensitive and Regulated Information
Riffle's applications are intended for business continuity, operational resilience, dependency mapping, risk assessment, and recovery planning.
Unless expressly authorized under a separate written agreement and appropriate contractual and technical arrangements, customers must not submit or process:

• Protected Health Information (PHI) regulated under HIPAA;

• Payment card information subject to PCI DSS;

• Highly sensitive personal information requiring specialized contractual or regulatory protections; or

• Other regulated information prohibited by applicable Riffle terms or agreements.

Customers are responsible for evaluating the suitability of information entered into the applications and complying with applicable organizational policies and regulatory requirements.

 

18. Children's Privacy
Riffle's website, products, and services are intended for business and professional use and are not directed toward children under 16 years of age.
We do not knowingly collect personal information directly from children through our website or services.
If we become aware that personal information has been collected from a child in violation of applicable law, we will take appropriate steps to address or delete that information.

 

19. Changes to This Privacy Policy
Riffle may update this Privacy Policy periodically to reflect changes in our products, data practices, security responsibilities, legal obligations, or applicable technologies.
The Effective Date at the beginning of this Policy indicates the date of the current version.
Material changes will be communicated through our website or other appropriate means, where required.
We encourage customers and website visitors to review this Policy periodically.

​

20. Contact Information
For questions about this Privacy Policy, privacy rights, data processing practices, or concerns about personal information, please contact:

 

Riffle Resilience Inc.

Attention: Privacy and Data Protection
9 Bancroft Road
Andover, MA 01810
United States

 

Email: privacy@riffleresilience.com

 

Website: www.riffleresilience.com

 

For application technical support, contact:
support@riffleresilience.com

 

Riffle will review privacy inquiries and respond in accordance with applicable legal and contractual requirements.