top of page

Trust Center

Security, privacy, and legal documentation for TestRay and Plum CRM, across Cloud and Atlassian Government Cloud deployments.

● TestRay AGC — FedRAMP Moderate

● AWS GovCloud (US)

● GDPR Aligned

● Last reviewed July 2026

Anchor 1

Security & Compliance at Goldfinger Software

Goldfinger builds enterprise tools for Atlassian Jira — TestRay for test management and Plum CRM for CRM integration. This Trust Center is the single source for security, privacy, and legal documentation across all products and deployment types.

● TestRay AGC — FedRAMP Moderate (FR2412062433)

● TestRay Bug Bounty — Enrolled

● AWS GovCloud (US)

● Atlassian Cloud Fortified / A4A In Progress

● GDPR Aligned

● NIST SP 800-53 Aligned

● NIST SP 800-61 Aligned

🔒 Privacy

Our Privacy Policy covers all products and deployments — GDPR, CCPA, U.S. state privacy laws, international data transfers, retention schedules, and cookies.

🛡 Security

Cloud architecture, encryption, access controls, vulnerability management, and incident response — covering TestRay Cloud, TestRay AGC, and Plum CRM Cloud.

📋 Legal

Terms of Service, Data Processing Addendum, Subprocessor List, Acceptable Use Policy, Service Level Agreement, and EULA for Data Center deployments.

🏛 Government (AGC)

TestRay is available on Atlassian Government Cloud — a FedRAMP Moderate authorized environment. All documents cover AGC alongside standard commercial Cloud deployments.

📐 Plans & Resources

Our Privacy Policy covers all products and deployments — GDPR, CCPA, U.S. state privacy laws, international data transfers, retention schedules, and cookies.

PRIVACY

Privacy Inquiries

privacy@goldfingerholdings.com
Data subject rights, DPA requests, GDPR

SECURITY

Security Reports

security@goldfingerholdings.com
Vulnerability reports, incidents, status.

LEGAL

Legal & Contracts

legal@goldfingerholdings.com
Countersigned DPA, ATO support, contracts

Plan Entitlements and Resources

Plan-Based Features and Limits define the Pro, Business, and Enterprise usage tiers for TestRay and Plum CRM Cloud — including storage limits, API rate limits, and professional services entitlements. Support response times in the SLA are tiered by the Pro, Business, and Enterprise plans defined here.

🧪 TestRay Plan-Based Features & Limits

Section 13 covers AGC-specific data handling — AWS GovCloud US-only residency, FedRAMP Moderate alignment, Privacy Act of 1974, FISMA, OMB A-130, NIST Privacy Framework, and the AGC sub-processor table.

📇 CRM Plan-Based Features & Limits

Features, storage limits (10 GB Pro / 25 GB Business / 25 GB+ Enterprise), API rate limits, on-demand resources, and professional services entitlements for Plum CRM Cloud. The Pro plan is referred to as the "Professional Tier" in the SLA.

SALES

Licensing & Upgrades

sales@goldfingerholdings.com
Enterprise plans, migration support, renewals

SUPPORT

Technical Support

Support Portal
Submit tickets, track requests

SLA

Service Level Agreement

goldfingersoftware.com/sla
Response times, support tiers, maintenance windows

Privacy Documentation

How Goldfinger collects, uses, stores, and protects personal information — across all products, deployments, and applicable privacy laws worldwide.

🔒 Privacy Policy

Our consolidated Privacy Policy covering all Goldfinger products. Includes GDPR rights, CCPA and U.S. state privacy laws, data retention schedules, international transfer mechanisms, cookie policy, and government (AGC) deployments in Section 13.

🌍 GDPR Compliance Overview

How Goldfinger processes limited business contact data in connection with its software services, and its practices under the EU General Data Protection Regulation — covering legal bases, data subject rights, and international transfers.

PRIVACY

Privacy Inquiries

privacy@goldfingerholdings.com
Data subject rights, DPA requests, GDPR

LEGAL

DPA & Transfer Mechanisms

legal@goldfingerholdings.com
Countersigned DPA, ATO support, contracts

ADDRESS

Goldfinger Holdings, Inc.

goldfingersoftware.com
10845 W Griffith Peak Dr, Suite 200
Las Vegas, NV 89135

Privacy Documentation

How Goldfinger collects, uses, stores, and protects personal information — across all products, deployments, and applicable privacy laws worldwide.

Security Documentation

Our security architecture, controls, and practices for TestRay Cloud, TestRay AGC, and Plum CRM Cloud — covering encryption, access control, vulnerability management, and incident response.

🔍 Cloud Security Overview

Architecture, encryption, access controls, logging, vulnerability management, and incident response across TestRay Cloud, TestRay AGC, and Plum CRM Cloud. Includes AGC-specific controls and an appendix for ATO reviewers and procurement teams.

🚨 Incident Response Policy

How Goldfinger detects, responds to, and recovers from security incidents — covering the six-phase NIST SP 800-61 lifecycle, incident classification, customer notification timelines, and FedRAMP IR-6 obligations for AGC deployments.

🐛 Vulnerability Disclosure Policy

How to report security vulnerabilities, what's in scope, safe harbour terms for researchers, and our remediation timelines by severity. Goldfinger participates in Atlassian's Marketplace Security Bug Bounty Program via Bugcrowd.

🔑 Access Control Policy

The principles, lifecycle controls, and technical safeguards governing access to Goldfinger's production infrastructure — including least privilege, MFA requirements, provisioning and revocation procedures, and AGC-specific US-persons requirements.

💾 Backup & Disaster Recovery Overview

Goldfinger's backup architecture for TestRay and Plum CRM Cloud — including RDS hourly backups with 30-day retention and point-in-time recovery, EFS daily backups, recovery time and point objectives, and cross-region failover for disaster scenarios.

SECURITY

Security Reports

security@goldfingerholdings.comVulnerability reports, incidents, document requests

BUG BOUNTY

Bug Bounty

Atlassian Marketplace Security Bug Bounty Program

ADDRESS

Goldfinger Holdings, Inc.

goldfingersoftware.com
10845 W Griffith Peak Dr, Suite 200
Las Vegas, NV 89135

Security Documentation

Our security architecture, controls, and practices for TestRay Cloud, TestRay AGC, and Plum CRM Cloud — covering encryption, access control, vulnerability management, and incident response.

Legal Documentation

The agreements that govern your use of Goldfinger products — covering Cloud subscriptions, data processing, acceptable use, support commitments, and Data Center deployments.

📄 Terms of Service

Governs your access to and use of TestRay and Plum CRM Jira Cloud apps — covering subscriptions, fees, usage rules, data, intellectual property, liability, and governing law. Applies to standard commercial and AGC deployments.

🤝 Data Processing Addendum

Sets out how Goldfinger processes and protects your data as a Data Processor — covering processor obligations, security measures, sub-processors, international data transfers, and data subject rights. Automatically incorporated into the Terms of Service.

🔗 Cloud Subprocessor List

The third parties engaged by Goldfinger to process customer data across TestRay Cloud, TestRay AGC, and Plum CRM Cloud — including core infrastructure sub-processors and conditional CRM integration sub-processors activated by Customer configuration.

✅ Cloud Acceptable Use Policy

The rules governing fair use, prohibited conduct, and enforcement across TestRay Cloud, TestRay AGC, and Plum CRM Cloud — including resource limits, security violations, and the national security and defense exception for government customers.

📊 Service Level Agreement

Support commitments for TestRay Cloud, TestRay AGC, and Plum CRM Cloud — covering incident classification, tiered response times across Pro, Business, and Enterprise plans, support channels, and scheduled maintenance windows.

💿 End User License Agreement (EULA)

Governs Data Center deployments of TestRay and Plum CRM — covering license grant, term, fees, restrictions, support, and Data Center-specific renewal terms. Does not apply to Cloud deployments.

PRIVACY

Privacy & DPA

privacy@goldfingerholdings.comSub-processor questions, data subject rights

SALES

Licensing & Renewals

sales@goldfingerholdings.comLicense upgrades, Enterprise plans, renewals

LEGAL

Legal & Contracts

legal@goldfingerholdings.com
Countersigned DPA, ATO support, contracts

Legal Documentation

The agreements that govern your use of Goldfinger products — covering Cloud subscriptions, data processing, acceptable use, support commitments, and Data Center deployments.

Government and AGC Deployments

TestRay is available on Atlassian Government Cloud — a FedRAMP Moderate authorized environment. All Goldfinger Trust Center documents cover AGC alongside standard commercial Cloud in a single unified set.

🔒 Privacy Policy

Section 13 covers AGC-specific data handling — AWS GovCloud US-only residency, FedRAMP Moderate alignment, Privacy Act of 1974, FISMA, OMB A-130, NIST Privacy Framework, and the AGC sub-processor table.

🤝 Data Processing Addendum

Dedicated AGC articles covering FedRAMP IR-6 incident notification, AWS GovCloud (US) residency and no-transfer covenant, federal procurement liability framework, federal records retention, and FISMA / Privacy Act precedence.

🔍 Cloud Security Overview

Section 12 covers AGC architecture and data flow, NIST SP 800-53 control-family alignment, and federal notification obligations. Appendix A is a technical deep dive for ATO reviewers and procurement teams.

🚨 Incident Response Policy

US-CERT/CISA and agency ISSO/AO notification within one hour of confirmed P1 incidents, three-year AGC incident record retention, and FedRAMP IR control-family alignment — alongside the standard NIST SP 800-61 lifecycle for all Cloud deployments.

📊 Service Level Agreement

AGC subscriptions are supported under the standard Cloud SLA — plan-tiered support across Pro, Business, and Enterprise tiers. Enhanced support terms for government and AGC customers are available on request.

🤝 Countersigned DPA

A bilaterally executed version of the Cloud DPA is available exclusively to U.S. federal, state, and local government customers for procurement or agency ATO purposes. All other customers accept the DPA automatically as part of the Terms of Service.

FEDRAMP

AGC AUTHORIZATION

FR2412062433
Atlassian Government Cloud — FedRAMP Moderate

SECURITY

Security & Compliance

security@goldfingerholdings.com

Security questionnaires, NIST controls, access control docs

GOVERNMENT & ATO

Legal & Procurement

legal@goldfingerholdings.comCountersigned DPA, ATO support, procurement docs

bottom of page