Where Gambit runs and who sees what
Gambit is built on Atlassian Forge and runs in your Jira Cloud site. Its code, your records and its AI all stay on Atlassian's Forge platform. Every request checks the caller, the licence and Jira permissions first. Deals, accounts and contacts are Jira work items in your own site.
Free on Jira sites of up to 10 users.
Gambit is hosted on Atlassian's Forge platform
Gambit installs in a Jira Cloud site, and Atlassian hosts it on Forge. When your Jira site is pinned to a location, Gambit's data in Jira and Forge storage is hosted there too. It moves with the site. Its AI runs on Forge LLM, in Atlassian's AI processing locations. Atlassian's Forge platform keeps each Jira site's data apart. A request for one site never reads another site's data.
Atlassian encrypts Forge storage at rest with AES-256. All traffic between your browser, Jira, the apps, Google and Microsoft is encrypted in transit.
Gambit Mail Sync connects to Google Workspace or Microsoft 365 only when your organisation connects them.
Each person opens only the records Jira lets them see
Before Gambit answers, it checks who is asking, their licence and their Jira permissions. It refuses when a check cannot complete. In setup you choose who sees customers, deals and their email, and you can change that later. A deal owner can make a deal private to the people they choose, and its email goes private with it.
Your Jira admins run Gambit's settings and access. Imports, activity history, privacy requests, diagnostics, exports of all data and the nightly archive stay with Gambit's admins group. Each of these shows or changes record content. Admin rights never open a private record: Jira's security levels set who can. To let someone run Gambit without making them a Jira admin, add them to its admins group.
On Jira Free, everyone on the site sees every record; private deals need Jira Standard or above.
Gambit's AI reads only what the person asking can open
Gambit's AI uses Atlassian-hosted models through Forge. It reads only what the person asking can open, and customer data never trains a model. Gambit's AI never changes a record on its own. A person accepts each proposal, and Undo is there if they change their mind.
App logs hold Atlassian account IDs, the cloud ID, the site host and record keys, and Atlassian's Forge logs keep them for 30 days. They never hold names, email addresses, subjects, message bodies, file names, field values, prompts or AI output. AI results' sources stay in your own site for 30 days, where admins can see them.
Gambit's AI is included in your subscription, with fair-use limits. Each person can run up to 25 Ask analyses a day, within a monthly fair-use limit for each person; questions that fit a report don't count. Summaries and other automatic AI draw on their own monthly pool. Your admins set how many analyses each person can run a day, and can give a person more. Reports, search and everything else keep working.
How the AI works · AI usage policy
Mail Sync reads mail with read-only permissions
Gambit Mail Sync reads mail with read-only permissions and can be limited to chosen mailboxes. It never sends, changes or deletes mail. Its tokens are held only as encrypted Forge secrets. A mailbox's tokens are deleted as soon as it is disconnected.
Payment card numbers and US Social Security numbers are masked wherever Gambit writes text, captured email included. Attached files, file names, images and text typed directly in Jira's own screens are not scanned.
Capture needs a paid Gambit plan.
Mail Sync requires an active Gambit subscription.
Microsoft 365 users connect their own mailbox wherever their IT allows it, or IT connects everyone; Google Workspace capture is connected by the IT admin; capture is labelled beta; personal Gmail opens after Google's review, with a waitlist.
Analytics are pseudonymous and admins can turn them off
Gambit sends product usage to PostHog and error reports to Sentry, both in the United States. Both are keyed by pseudonymous IDs. Neither receives names, email addresses, record content or prompts. Both are on by default, and admins turn them off in Atlassian's admin controls.
Penetration testing, incidents and vulnerability reports
An independent penetration test runs in January and February 2027. Its summary letter goes on the trust page when it is complete.
Our staff have no standing access to your data. Support starts from the diagnostics an admin chooses to share. If a security incident affects your data, we tell you within 72 hours of confirming it. Critical issues get a first response within 2 hours, around the clock.
To report a vulnerability, email our security team. We acknowledge reports within two business days.
The documents your security review needs
Questions and answers
Where does Gambit store our data?
In your Jira site and in Forge storage, both hosted by Atlassian. If your Jira site is pinned to a location, that data is hosted there too. It moves when the site moves. The AI runs on Forge LLM, in Atlassian's AI processing locations. Its results are stored back in your site.
Is Gambit SOC 2 certified?
No. Gambit holds no SOC 2 or ISO 27001 certification of its own. It is hosted on Atlassian's certified cloud platform, whose audit reports are on the Atlassian Trust Center. An independent penetration test of both apps runs in January and February 2027. Start your review with the security questionnaire and CAIQ Lite in the trust pack.
What happens if we uninstall?
Your deals, accounts and contacts stay in Jira as work items, with their files attached. Your customer history never sits hostage in another system. Atlassian keeps the app's Forge storage for at most 28 days after uninstall. Before you uninstall, the backup and export guide shows how to take your own copy.
Gambit's own indexes and AI working state go when you uninstall, except what its nightly Gambit Archive item keeps.
Who can open a private deal?
The people the deal owner chooses. The deal's email is limited to the same people, everywhere Jira checks permissions. Jira's security levels set who can open it, so admin rights alone don't. Setup's access choice sets who sees customers and deals across the site; a private deal narrows that for one deal.
On Jira Free, everyone on the site sees every record; private deals need Jira Standard or above.
Get on the Gambit mailing list
Gambit is on its way to the Atlassian Marketplace.