GambitSecurity and privacy
Gambit keeps your customer data in your own Atlassian cloud, shows each person exactly what Jira lets them see, and follows your Jira site's data residency.
Trust documents
- Trust center: how Gambit protects your data, what is stored where, and our security controls.
- Data Processing Addendum: our processor terms, ready to sign.
- Subprocessors: every service that processes data for Gambit.
- AI Usage Policy: what Gambit's AI reads, where it runs and what it keeps.
- Data Retention: how long each kind of data is kept, and what happens when you uninstall.
- Security questionnaire: our answers to the questions security teams ask, ready for your review.
- Privacy policy and End User Terms.
Gambit runs on Atlassian-hosted infrastructure; a third-party penetration test is scheduled for early 2027.
How access works
- Anyone Jira lets see a record sees all of it. Gambit's records are Jira work items protected by Jira's own permission schemes and issue security levels, so Jira search, dashboards, Rovo, the Jira mobile app and Gambit all show the same records to the same people.
- Gambit's AI sees what you can see. Gambit's AI runs on models hosted by Atlassian. It reads what you can see in Jira and nothing more. Your data isn't used to train models.
- Your data stays in your Atlassian cloud. Gambit runs no servers of its own that hold customer data. Your records live in Jira, and Gambit's own data lives in Forge storage on your site.
- Gambit Mail Sync connects to your mail. It reads Google Workspace mail and calendars with the access your IT admin, or each person, approves, and writes customer email onto your Jira work items.
Your whole team sees every customer email on the account and deal; mark a thread Private to keep it to you and the people Jira allows. By default, that means the owner and members of rainbook-admins. A deal owner can make a deal private to the people they choose. See the Admin guide for access settings, private deals and Jira Free.
Jira plan limit
On Jira Free, everyone on the site sees every record; private deals and private threads need Jira Standard or above.
Jira keeps a work item to a few people with issue security, and Jira Free doesn't have it. So on Jira Free the setup wizard skips its Access step and Gambit hides the Private toggle and its other privacy controls. When you upgrade to Jira Standard, Gambit notices within a day, offers to add its security levels, and then gives every record the right level for you.
Permissions Gambit asks for
Atlassian shows each app's permissions before you approve an install. This is what each one is for.
| Gambit | What it's for |
|---|---|
read:jira-work | Read work items, comments, properties and searches, and check permissions, so every screen shows a record only to people Jira lets see it |
write:jira-work | Create and edit the CRM's work items, comments, attachments, properties and links, and erase a person's data when they ask |
read:jira-user | Look up people and their groups for permission checks |
read:email-address:jira | Match a support request's reporter to a customer contact |
read:servicedesk-request | Link support requests, their service levels and participants to customer accounts |
manage:servicedesk-customer | Read service desk organizations and their members, to link support requests to accounts |
manage:jira-project | Create Gambit's spaces with their components, roles and space properties |
manage:jira-configuration | Set up work types, fields, workflows, screens and permission, notification and security schemes from the admin's browser, and read the license count |
read:license:jira, read:application-role:jira | Read the site's user count and application roles, to size your plan |
read:app-data:jira, write:app-data:jira | Read Gambit's feature switches and installed packs, and write Gambit's field values on work items |
storage:app | Keep Gambit's indexes, settings and queues in Forge storage on your site |
report:personal-data | Tell Atlassian which accounts Gambit stores, for personal-data requests |
redact:issue:jira | Redact change history when a person asks to be erased |
| Gambit Mail Sync | What it's for |
|---|---|
read:jira-work | Find the Conversations and Meetings already in Jira, so each email thread and meeting is written once, and read the shared settings Gambit keeps on its system item; the inbox sidebar, which is coming soon, also reads the records it shows, as the paired person and under their permissions |
write:jira-work | Create Conversations and Meetings with their comments, attachments and properties, and log a thread from the inbox sidebar as the paired person (the sidebar is coming soon) |
read:jira-user | Match mailbox owners, and people who pair a sidebar, to Atlassian accounts |
read:group:jira, read:user:jira | List the members of your Gambit users group, with their names and email addresses, so admins can pick whose mailboxes to capture |
read:avatar:jira | Part of the same group listing, for the list admins pick whose mailboxes to capture from |
storage:app | Keep the capture ledger, sync cursors and connection secrets in Forge storage on your site |
report:personal-data | Tell Atlassian which accounts Mail Sync stores, for personal-data requests |
Every service outside Atlassian that either app can reach is listed under Out of scope, with what it receives and when.
Data residency
Gambit stores End-User Data only in Atlassian products and in Forge hosted storage, and both support data residency. When your Jira site is pinned to a location, or you move it to another one, Gambit's data is hosted in the same location and moves with it.
What Gambit keeps in Forge storage
Everything Gambit stores outside your Jira work items sits in Forge hosted storage on your site (Forge SQL, the Key-Value Store, the Custom Entity Store and the Forge Object Store). It is in scope for data residency and follows your Jira site's location:
- the people index and email search index, including short message previews and search terms;
- the reporting mirror behind Ask, reports and dashboards;
- activity history, with older entries in archive files;
- AI results (summaries, health reasons, briefs and drafts) and the 30-day traces behind Show sources;
- reference data, import maps and imported email history older than 90 days;
- settings, saved views and Gambit's job state;
- for Gambit Mail Sync: mailbox connection tokens, sync cursors, the message ledger and a short-lived capture buffer.
What lives in Jira
Your customer records are Jira work items, so they follow your Jira site's data residency exactly like any other Jira data:
- accounts, contacts, leads, deals, renewals, follow-ups and industry-pack records, with all their fields;
- email threads and meetings, with full message bodies, senders and recipients, attachments and inline images;
- Gambit's values stored on each work item, which keep your data readable after an uninstall;
- the nightly Gambit Archive item and its archive files.
In-scope End-User Data
Gambit treats all of the following as in-scope End-User Data. It is stored only in your Jira site or in Gambit's Forge storage on your site, and the last column says what happens to it if you uninstall (see Uninstall and what you keep).
| End-User Data | Where Gambit stores it | After you uninstall |
|---|---|---|
| Contacts and leads: names, email addresses, phone numbers, titles and other details | Jira work items | Kept in Jira |
| Accounts, deals, renewals, follow-ups, promises and industry-pack records, with amounts, dates, stages, notes and every field | Jira work items | Kept in Jira |
| Email and calendar content: subjects, bodies, senders, recipients, attendees, attachments, inline images and meeting details | Jira work items (Conversations and Meetings) | Kept in Jira |
| Your team's Jira account IDs on records, such as owners, account teams and the people a private deal is shared with, and Gambit's values on each work item | Jira fields and issue properties | Kept in Jira |
| The nightly Gambit Archive item and its archive sets | A Jira work item | Kept in Jira |
| The people and email search indexes: names, email addresses, thread participants, short message previews and search terms | Forge SQL | Removed |
| The reporting mirror and reporting history: copies of record fields for Ask, reports and dashboards, field changes, daily snapshots, targets and forecast calls | Forge SQL | Removed |
| Activity history: who changed what, with old and new values | Forge SQL, with older months in archive files in the Forge Object Store | Removed; export it first from Settings › Activity history |
| Questions people ask Gambit's AI, and its answers, summaries, health reasons, briefs, drafts and proposals | Forge SQL | Removed |
| AI traces behind Show sources: the prompt, the sources read and the output, kept for 30 days | Forge SQL and the Forge Object Store | Removed |
| Files you import from another CRM, import maps and imported email history older than 90 days | Forge SQL and the Forge Object Store | Removed |
| Privacy requests: the address a request is about, replaced by a fingerprint when the request ends | Forge SQL | Removed |
| Settings, saved views, delivery templates, blocked addresses and domains, and Gambit's job state | The Key-Value Store and the Custom Entity Store | Removed |
| Gambit Mail Sync's mailbox connections, sync state and message ledger | The Custom Entity Store, with connection tokens encrypted in the Key-Value Store | When you uninstall Gambit Mail Sync, capture stops and Mail Sync revokes the Google sign-in tokens of people who connected their own Google mailbox, most recently used first. Atlassian deletes the app's Forge-hosted data 28 days after uninstall; a reinstall requested within 21 days can be relinked to that data. Reconnect mailboxes after a reinstall. |
| Gambit Mail Sync's capture buffer: messages on their way into Jira | The Forge Object Store, briefly | Removed |
Atlassian keeps removed Gambit storage for its standard recovery period and can relink it to a reinstall you request within 21 days.
Out of scope
These are not stored in Gambit's storage, and each carries no record content unless stated:
- Product analytics (PostHog): pseudonymous site and user IDs, screens, features used and timings. Error reports (Sentry): the error's type and stack frames and a scrambled site ID, with no person identifier. Neither carries any of the in-scope data above.
- App logs in Atlassian's Forge platform: Atlassian account IDs, your site's cloud ID and host, and record keys, kept for 30 days. Never names, email addresses, subjects, message bodies, file names, field values, prompts or AI output.
- AI processing. Gambit's AI runs on models hosted by Atlassian, in Atlassian's AI processing locations, under the Atlassian terms that govern them. The results are stored in your Jira site and Gambit's storage, as above.
- Your mail provider. Gambit Mail Sync reads mail and calendars from your own Google Workspace, where Google keeps them.
- The Gmail sidebar is coming soon. When it arrives, it runs on Google Apps Script, shows record details only to the person using it, and keeps only a pairing token, never record data.
- Company logos. Gambit Mail Sync sends a company's web domain, and nothing else, to logo.dev to fetch its logo, which Gambit then stores on the account in Jira. Logos by Logo.dev.
- The Gambit website. gambit.humanr.ai hosts these pages and holds no customer data.
- Diagnostics you choose to share with Gambit support leave your site only through your own browser, when you attach them to a support request.
Product analytics and error reports
Gambit sends usage analytics to PostHog and error reports to Sentry so we can see which features help you and fix problems quickly. Analytics events carry screens, features used and timings, keyed by pseudonymous site and user IDs. Error reports carry the error's type and stack frames and a scrambled site ID, and nothing that identifies a person. Neither ever carries names, email addresses, record content or prompts, and error reports are scrubbed before they leave.
Analytics are on when you install. Your admins can switch them off in Atlassian's admin controls, and every Gambit feature works the same with them off.
Card and SSN masking
Gambit masks payment card numbers and US Social Security numbers everywhere it writes: captured email bodies and subjects, calendar events, imports, Gambit's forms and AI output. A card number becomes "[card ending 4242 removed]" and a Social Security number becomes "[SSN removed]" before anything is saved, and the rest of the message is kept.
Settings › Privacy and data shows how many numbers Gambit removed this month. Masking is always on. It covers the text Gambit writes; attachments and edits people make directly in Jira aren't scanned.
Gambit is built for customer relationships, not for health records, government identifiers or other special-category data, and the end user terms don't allow storing it.
Report a vulnerability
If you find a security issue in Gambit or Gambit Mail Sync, tell us at security or email security@gambit.humanr.ai. We acknowledge every report and keep you updated until it's fixed. For privacy questions and data requests, email privacy@gambit.humanr.ai.