Has your Jira analytics app ever been tested by independent security researchers?
March 14, 2026
A few months ago, we put SnapMetrics — Real Time Analytics through Atlassian’s Marketplace Bug Bounty Program. Independent security researchers tested the app for vulnerabilities. It passed.
That outcome combined with meeting Atlassian’s full set of reliability and support requirements is what earned us the Cloud Fortified badge. We’re not sharing this to boast. We’re sharing it because if you’re evaluating a Jira analytics tool, you deserve to know what’s actually been verified and by whom.
This post explains the Cloud Fortified program, what it actually required from us, what SnapMetrics — Real Time Analytics does, and why we think it’s worth a try.
What Is Cloud Fortified?
Cloud Fortified is Atlassian’s highest-tier trust certification for Marketplace apps. It’s not self-reported it’s earned by meeting verified requirements across three areas: security, reliability, and support.
Every Marketplace app meets a baseline. Cloud Fortified goes further. The two differentiating requirements are the Bug Bounty Program and the annual Security Self-Assessment both are opt-in programs that become mandatory at the Cloud Fortified tier.
Why this matters for your teamSecurity and compliance are among the top concerns for IT managers evaluating cloud apps Atlassian’s own research puts it at 40%. Cloud Fortified gives you a clear, Atlassian-verified answer to the question: has this app been independently tested, and does the partner maintain it responsibly?
What the Process Actually Looked Like
Here’s a plain-language breakdown of what earning Cloud Fortified required from us:
On the security side
- Ecoscanner: Atlassian’s automated platform continuously scans SnapMetrics — Real Time Analytics for common vulnerabilities. Any findings must be resolved within defined SLAs.
- Vulnerability Disclosure Program: We participate in the program that allows customers and security researchers to report vulnerabilities directly to Atlassian and to us.
- Bug Bounty Program: We enrolled in the Marketplace Bug Bounty Program, where independent security researchers actively tried to find vulnerabilities in SnapMetrics — Real Time Analytics. The app passed. This is an opt-in program — not all Marketplace apps participate, but it’s required for Cloud Fortified.
- Annual Security Self-Assessment: We complete a full security assessment every year. Atlassian reviews and approves it. Another opt-in program that becomes mandatory at the Cloud Fortified tier.
On reliability
- SLI/SLO monitoring: Core capabilities of SnapMetrics — Real Time Analytics are measured against defined service level indicators and objectives on an ongoing basis.
- Compatibility testing: We proactively test against upcoming Jira updates to catch breaking changes before they reach you.
- Incident management: Our incident response process is integrated with Atlassian’s, which means faster recovery when issues occur.
On support
- 24-hour T1 response: If SnapMetrics — Real Time Analytics is preventing you from working, you will hear from us within 24 hours, 5 days a week during local business hours. This is a contractual commitment, verified by Atlassian.
Standard Marketplace App vs. Cloud Fortified: The Actual Difference
A lot of good apps on the Marketplace aren’t Cloud Fortified, that doesn’t make them untrustworthy. But if you’re deciding between apps, here’s what the badge tells you:
Get Snapbytes’s stories in your inbox
Join Medium for free to get updates from this writer.
Standard Marketplace App vs. Cloud Fortified
The short version: standard Marketplace apps meet Atlassian’s baseline. Cloud Fortified apps have been tested further active bug bounty, annual self-assessment, reliability SLOs, and support SLAs that Atlassian verifies.
What SnapMetrics — Real Time Analytics Actually Does
For those new to the app: SnapMetrics — Real Time Analytics is a real-time performance tracking and analytics tool for Jira, built on Atlassian’s Forge platform.
The core idea is that Jira captures a lot of valuable data as your team works status changes, transitions, assignments, time logs. SnapMetrics — Real Time Analytics makes that data immediately visible and actionable. No spreadsheet exports, no waiting for a scheduled report. You define the metrics you actually care about, and you see them live.
SnapMetrics — Real Time Analytics: Reports & Features
Define your own metrics — not just the pre-built ones
One thing that sets SnapMetrics — Real Time Analytics apart is the flexibility of its metric system. No admin setup required anyone on the team can create a custom metric based on the events and data points that matter most to their workflow:
Metric Types You Can Define
Live tracking and historical data work together: SnapMetrics — Real Time Analytics handles both day-to-day operational visibility and longer-term trend analysis. Sprint-by-sprint delivery velocity, team capacity over quarters, workflow bottleneck patterns that only emerge over time, it’s all in one place.
Why We’re Sharing This
We know the Atlassian Community evaluates apps carefully, and rightly so. When you install a third-party app, you’re extending trust to a partner you may not know much about. We wanted to be transparent about what we’ve done to earn that trust, not just claim it.
If you’re using SnapMetrics — Real Time Analytics and have feedback, we want to hear it. If you’re considering it, feel free to drop questions below we’re active here and respond to every comment. And if you’ve been through the Cloud Fortified process yourself, we’d genuinely love to compare notes.
