Runs on Atlassian
Q&A Knowledge Base is built only on Atlassian Forge. Eligibility for Atlassian's Runs on Atlassian program was checked on 14 October 2026.
Where your data goes
Nowhere outside Atlassian. The app declares no outbound network access, no web triggers, no remotes, no external backend, no analytics, no email and no third-party service. All processing happens in Forge functions. Questions, answers and comments are stored by Confluence itself; the app's own data is in Forge storage on your site.
Forge storage follows the data residency of the host product (your Confluence or Jira site). Atlassian runs Forge functions on its own infrastructure and aims to run them in the same region.
What is stored
Besides the content that Confluence stores, the app keeps this in Forge storage on your site.
| Data | Why | How long |
|---|---|---|
| Configuration: enabled spaces, home space, role rules (group names), switches | Settings | Until changed or the app is uninstalled |
| Question and answer metadata: Confluence content id, space key, author account id, times, tags, vote counters, accepted answer, closed or duplicate information (who, when, reason, target). For imported posts: the original author's display name as text, the original date and the id used in the CSV | Confluence has no place for them | Until the post is deleted or the app is uninstalled |
| Votes: voter account id, post id, +1 or -1 | One vote per person, counters, "my votes" | Until the vote is removed, the post is deleted or the account is reported closed |
| Watches: account id, question id | In-app watching | Until unwatched, the question is deleted or the account is reported closed |
| Inbox entries: event kind, question id, answer id, id of the account that acted, time | In-app notifications | 90 days, then deleted automatically |
| Cache of a user's groups and administrator flag | Speed | Up to 10 minutes |
| Tag directory: tag name and approximate use count per scope | Tag suggestions | Recomputed with use; until uninstall |
| List indexes: ids, space keys, times, scores | Fast lists | With the post |
| System records: search health, time of the last personal data report | Operation | Until uninstall |
| Import jobs: the parsed rows of an uploaded CSV file (texts, author names) | Run the import in steps | The file content is deleted when the job finishes or is cancelled. A job that is abandoned expires 3 days after its last change at the latest |
| Export jobs: the generated CSV, in parts | Hand the file to the administrator who started the export | 15 minutes |
Personal data
Atlassian account ids (authors, voters, watchers, inbox owners), group names, and anything users type into questions, answers and comments (stored in Confluence). Imported posts can carry the original author's name as text from the CSV file. The app requests and stores no email addresses or profile data; names shown in the interface are read from Confluence when needed. A daily scheduled function reports the stored account ids to Atlassian's personal data reporting API at least every 7 days. For accounts reported as closed it deletes their votes, watches and inbox and removes the account from post metadata. The posts stay.
Permissions
Every permission the app requests, and why. The scopes are granular unless the table says otherwise.
| Scope | Why the app needs it |
|---|---|
storage:app | Forge storage on your site for votes, tags, watches, inbox, configuration and indexes |
read:custom-content:confluence | List and read questions and answers |
write:custom-content:confluence | Create and edit questions and answers |
delete:custom-content:confluence | Delete questions and answers (author or moderator) |
read:comment:confluence write:comment:confluence delete:comment:confluence | Comments on questions and answers (Confluence footer comments) |
read:space:confluence | Space picker, space settings, and checking that a user may see a space |
read:content-details:confluence | Full-text search (CQL) over questions and answers |
read:user:confluence | Show names and recognise administrators |
read:group:confluence | Role rules by group, and the group picker in the settings |
report:personal-data | Report stored account ids to Atlassian's personal data reporting API |
Offline user impersonation (allowImpersonation) is enabled on five read scopes: custom content, space, content details, user and group. It is used only by the optional Rovo action, which runs without a browser session and acts as the person talking to the agent, so Confluence's own permissions decide what it can find.
Access control
Every Confluence request is made with the identity of the user, so their permissions decide what they see. One exception: when a moderator edits or deletes someone else's question, answer or comment, Confluence may refuse the moderator, and the app then acts with its own identity, after checking the moderator role itself. Input from the interface is validated for shape and size on the server. Post text is reduced to a small allow-list of formatting, and links to http, https, mailto and site-relative paths. Roles are enforced on the server; hidden buttons are cosmetic.
Other points
No web triggers
Nothing is served from a web address. The CSV export is created inside Atlassian, only the administrator who started it can read it, and the temporary export data is deleted from Forge storage after 15 minutes.
Rovo (optional)
The optional Rovo action and agent are Atlassian's Rovo features. The action only returns text found in Confluence to Rovo, which processes it under Atlassian's terms. Customers who do not use Rovo are unaffected.
Logging
Unexpected errors only (class and message). The app does not log question text or user data on purpose. An error message returned by Confluence could mention a title.
Encryption
Data in transit and at rest is protected by the Atlassian Forge platform. The app has no database or storage outside Forge.
Sub-processors
None besides Atlassian.
AI and language models
None in the app itself. The optional Rovo agent and action are Atlassian's Rovo features (see above).
Vulnerabilities and incidents
We fix vulnerabilities within the windows Atlassian requires of Marketplace apps (critical: 10 days, high: 4 weeks, medium: 12 weeks, low: 25 weeks) and tell Atlassian about security incidents within 48 hours. Dependencies are checked for known vulnerabilities before each release.
Report a vulnerability to support@karelialabs.atlassian.net. Please include what you found, how to reproduce it and which app and version are affected, and give us a reasonable time to fix it before you publish details.
Deleting data
Authors and moderators can delete posts in the app. The post is removed through Confluence, which applies its own trash rules, and the app deletes its data about it. Uninstalling removes the app's stored data under Atlassian's Forge rules. What Confluence keeps of the content itself after an uninstall is governed by Confluence.