Security and data

Where your data goes

Nowhere outside Atlassian. The app declares no outbound network access, no remotes, no external backend, no analytics, no email and no third-party service, and it requests no content or external permissions, so the macro runs under Forge's default content security policy (no inline script, no eval, no external hosts). The specification is read by a Forge function as the viewing user and parsed in that user's browser.

Forge storage follows the data residency of the host product (your Confluence or Jira site). Atlassian runs Forge functions on its own infrastructure and aims to run them in the same region.

What is stored

The app uses no Forge storage of any kind: no key-value store, no SQL, no entities, no object store. The macro settings (file name, display options and, if an editor pastes the specification, its text) are stored by Confluence in the page itself, not by the app. A reader's colour mode choice is kept in the browser's local storage of the macro, if the browser allows it.

Personal data

None is stored by the app. Atlassian account ids exist in memory for the duration of a call and are not stored or logged. Because the app stores no personal data, it has nothing to report to Atlassian's personal data reporting API and requests no scope for it.

Permissions

Every permission the app requests, and why. The scopes are granular unless the table says otherwise.

This is the only scope. There is no write scope, no impersonation and no app-level access.

Access control

Every Confluence request is made with the identity of the person viewing the page. A user who cannot see the page or the attachment gets an error and no content. The license is checked in the Forge function, on the server, before any specification text is returned.

Untrusted input

Specifications are untrusted input. They are parsed as data (no code execution, a limit on YAML aliases, size limits of 4 MB per file and 200,000 pasted characters). Markdown in descriptions becomes elements, never HTML. Only http and https links are clickable, and they open through the Forge bridge; email addresses are shown as text. Automated tests cover hostile specifications: script tags, event handlers, javascript links, alias bombs and deeply nested documents.

Dependencies

Eight packages are bundled into the browser code: five open source packages (Preact, yaml, tslib, lodash and iframe-resizer) under permissive licenses, and three Atlassian Forge SDK packages. The build fails if an open source package with another license appears. The list with license texts ships with the app.

Logging

Error class and message only. Page content, attachment content and pasted text are never logged.

Encryption

Data in transit and at rest is protected by the Atlassian Forge platform. The app has no database or storage outside Forge.

Sub-processors

None besides Atlassian.

AI and language models

None. The app does not use Forge LLM and sends no content to any model.

Vulnerabilities and incidents

We fix vulnerabilities within the windows Atlassian requires of Marketplace apps (critical: 10 days, high: 4 weeks, medium: 12 weeks, low: 25 weeks) and tell Atlassian about security incidents within 48 hours. Dependencies are checked for known vulnerabilities before each release.

Report a vulnerability to support@karelialabs.atlassian.net. Please include what you found, how to reproduce it and which app and version are affected, and give us a reasonable time to fix it before you publish details.

Deleting data

There is nothing to delete. Uninstalling removes the app. Specifications that people attached or pasted remain in their pages, because that content belongs to the customer.