Encryption at Rest

Everything Gambit and Gambit Mail Sync store is encrypted at rest by Atlassian, because both apps keep your data only in your Jira site and in the Forge storage Atlassian hosts for it. There is no Gambit server or database to protect separately.

What is encrypted, and how

Data	Where it is stored	Encryption at rest
Deals, accounts, contacts, conversations, meetings, their fields, comments and attachments	Jira work items in your site	Encrypted under Atlassian's cloud security controls for Jira
Gambit's indexes, reporting tables, activity history, AI working state and settings	Forge storage for your site: Forge SQL, key-value storage and Object Store	AES-256, managed by Atlassian
Gambit Mail Sync's connections and capture state	Gambit Mail Sync's Forge storage for your site	AES-256, managed by Atlassian
Google mailbox tokens (and Microsoft's, in Gambit Mail Sync Beta)	Encrypted Forge secrets in Gambit Mail Sync's storage	AES-256, plus Forge's encrypted secret storage; never shown, and never sent to Gambit

Mailbox tokens are deleted as soon as a mailbox is disconnected, and Google sign-in tokens are revoked with Google first.

Encryption in transit

Every connection between your browser, Jira, the two apps, Google and, for Gambit Mail Sync Beta, Microsoft uses TLS 1.2 or higher. This website is served only over HTTPS, with HTTP Strict Transport Security, and stores nothing you send through its sign-in pages.

What leaves your Atlassian cloud

Gambit Mail Sync reads mail and calendars from Google (and Gambit Mail Sync Beta also from Microsoft) with read-only permissions and writes them to your Jira site; nothing leaves your Atlassian cloud on the way. Usage analytics and error reports go to PostHog and Sentry without names, email addresses, record content or prompts; read Data Handling for what they carry and how to switch them off.

Questions

Write to security@gambit.humanr.ai. The trust centre has the rest of our security and privacy documents.