This plugin stores no data itself, it only allows to access data from a rest endpoint is fetched but never stores anywhere. It is the responsibility of whoever configures the plugin for a particular JIRA installation to ensure there is no problem regarding security and privacy.