1. Introduction

This IT Security Policy describes Firnity's requirements for protecting company, customer, and personal data and responding to security incidents. It applies to Firnity Discord for Confluence and the systems used to develop, operate, and support it.

Prevention is central to this policy. Security controls must be proportionate to the sensitivity of the data and the access available through Confluence, Forge, Discord, the Firnity remote service, provider consoles, source control, and support communications.

2. Responsibilities

Łukasz Wiatrak, as Firnity's business owner and designated security and data-protection contact, is responsible for the day-to-day implementation of this security policy. He is responsible for selecting and maintaining proportionate controls, reviewing access, responding to suspected incidents, coordinating required customer or authority notices, and keeping public security and privacy disclosures aligned with current operations.

Anyone authorized to work on Firnity systems must protect the data and credentials they handle, follow least-privilege access, preserve confidentiality, and report a lost device, suspicious activity, unauthorized access, or possible data breach promptly. External vulnerability reports may be sent to contact@firnity.com.

3. Information Classification

Data Processed for Firnity Discord for Confluence must be categorized so that proportionate security measures can be applied. The classification system includes:

Public: Information approved for the general public, such as published documentation and Marketplace materials. Public classification does not permit unauthorized alteration.

Internal: Non-public operational information whose disclosure could hinder development, support, or business operations. Access is limited to a legitimate work purpose.

Confidential: Customer data, personal data, source code that exposes security-sensitive behavior, non-public vulnerability reports, contractual material, and operational records requiring explicit authorization and need-to-know access.

Regulatory: Data governed by applicable law, a regulator, or a binding contractual requirement. Access, retention, disclosure, and incident handling must follow the applicable requirement.

4. Security Software and Tools

To protect data and systems, the following security measures and tools are required:

  • Anti-Malware: supported endpoint protection must be enabled and kept current on devices used to access Firnity systems.
  • Anti-Virus: operating-system or maintained third-party protection must provide continuous malware and threat detection where supported.

Security tools must receive updates, must not be disabled to bypass a security control, and must be reviewed when a device, operating system, provider, or threat model materially changes.

5. Device Security and User Responsibilities

All users are responsible for the secure handling of any device they use for Firnity work, including laptops, phones, and tablets. To ensure device security:

  • Software Updates: install supported operating-system, browser, application, and security updates promptly.
  • Firewall: keep the device firewall enabled where the operating system provides one.
  • Anti-Malware: keep supported malware and virus protection enabled and current.
  • Account Security: use separate user accounts and do not use a privileged administrator session for routine work where the platform supports separation.
  • Automatic Lock: configure devices to lock after a reasonable period of inactivity and require authentication to resume.

If a device is lost, stolen, or suspected to be compromised, access must be revoked or rotated as appropriate and the incident must be assessed promptly.

6. Password Guidelines

To protect user accounts and sensitive data:

Change Default Passwords: default passwords and PINs must be changed before a device, account, or service is used for Firnity work.

  • Enable Two-Factor Authentication (2FA): use multi-factor authentication for provider, source-control, email, Atlassian, Discord, cloud, and administrative accounts where available.
  • Use Strong, Unique Passwords: do not reuse a password across critical systems.
  • Password Management Software: use an appropriate password manager rather than storing credentials in source code, documentation, tickets, or unprotected notes.
  • Do Not Share Passwords: use provider roles and delegated access instead of sharing an individual credential.
  • Protect Recovery Material: recovery codes, API credentials, signing keys, and secret-bearing URLs require the same or stronger protection as passwords.

Following these requirements reduces the risk of unauthorized access. Application secrets and tokens must not be included in source code, public documentation, support replies, telemetry, or vulnerability reports.

7. Be Alert to Other Security Risks

Technology controls must be supported by careful operational behavior. Follow these practices:

  • Stay Informed: monitor relevant Atlassian Forge, Discord, Azure, dependency, and security advisories.
  • Exercise Caution with Emails: treat unexpected links, attachments, credential requests, OAuth grants, and provider notices as potentially malicious until verified.
  • Report Suspicious Activity: report suspected phishing, malware, unauthorized access, exposed credentials, data loss, or other threats promptly.
  • Use Secure Internet Practices: avoid exposing confidential data over untrusted networks and use encrypted provider connections.
  • Report Vulnerabilities Responsibly: send a description, affected Firnity Discord for Confluence component or URL, reproducible steps, potential impact, and safe supporting evidence to contact@firnity.com.
  • Protect Other People and Systems: do not access, copy, change, retain, or disclose customer data; do not use denial of service, social engineering, credential attacks, destructive payloads, high-volume automated scanning, or testing against Atlassian, Discord, Microsoft, Google, or another third party.
  • Coordinate Disclosure: do not publicly disclose a suspected vulnerability before Firnity has had a reasonable opportunity to investigate and address it.

Firnity welcomes good-faith reports, but this policy does not create a bug bounty, blanket authorization to test, legal safe harbor, guaranteed acknowledgement time, or remediation deadline. Request written authorization before performing active security testing beyond normal use of an account and data you control.