As an Atlassian Connect add-on, Wizeline's add-on follows the requirements for resource scope as outlined in Atlassian's documentation.
We are configured for both READ and WRITE scope. READ is required across your projects and issues metadata to sync information about your JIRA issues to Wizeline. WRITE is required to create new JIRA issues from Wizeline and map to your JIRA issues from Wizeline (an upcoming Wizeline feature). You can confirm this information by referencing the scopes field in the installation url for the Wizeline add-on.
This noted, it's possible to avoid exposing confidential information by modifying your security schema in JIRA for those projects and issues that you would like to deny access to our add-on.
When our add-on is installed, a special user is created to communicate with your JIRA instance. By default, this user should be called "Wizeline Connect," with the username "addon_com.wizeline.connect-production." By denying access to that user into your confidential projects or issues, the add-on won't be able to read or write into them. As a result, some issues may occur if the add-on is activated or used on those projects or issues in JIRA. Please contact Atlassian Support if you need help with your security schemas.
We only read issues and related metadata (e.g., issue types, JIRA projects) for use on our mapping operations. We also don’t create any public endpoints to expose information.
When you grant the Wizeline add-on incoming access to your JIRA instance, the add-on accesses JIRA using the JIRA username and password you provide in order to support syncing from Wizeline. The access level of any write and read operations done from within Wizeline will be determined by your security settings regarding the authorized user.