Runs on Atlassian
Treewright is built only on Atlassian Forge. Eligibility for Atlassian's Runs on Atlassian program was checked on 14 October 2026.
Where your data goes
Nowhere outside Atlassian. The app declares no outbound network access, no remotes, no external backend, no analytics, no email and no third-party service. All processing happens in Forge functions, and the app's own data is in Forge storage on your site.
Forge storage follows the data residency of the host product (your Confluence or Jira site). Atlassian runs Forge functions on its own infrastructure and aims to run them in the same region.
What is stored
Treewright stores the following in Forge storage on your site. Page bodies and attachments are never stored: they are read in memory while a job runs and written back to Confluence through its own API. Lists of people in page restrictions are read from Confluence while a job runs and are not stored.
| Data | Why | How long |
|---|---|---|
| Job records: job id, status, counters, the page ids and titles of the copied tree, the title rule and options, values typed into a template form, a short note log | Resume, progress and report | Deleted automatically after 90 days. Users can remove a job earlier. |
| Rewritten-link report: page ids, link kind, before and after text (titles and URLs) | The job report | Same as the job |
| Templates: name, description, variable definitions, id and title of the source page, options, and short excerpts of page text (about 40 characters each, at most 20) around placeholders that could not be read | The template registry, and the warning about placeholders that formatting has split | Until deleted by a user or the app is uninstalled |
| Edit restriction rules: page id, title and space key, scope, id of the user who created the rule | The optional rule | Until deleted or uninstalled |
| Rule activity log: time, page id, result text | Troubleshooting | 14 days |
| Short markers: page ids of copies made by a running job | Keep the rule trigger from interfering with a running copy | A few hours |
Personal data
Atlassian account ids (the user who started a job or created a template or a rule) and anything users type into page titles or template values. The app requests and stores no names, email addresses or profile data. A daily scheduled function reports the stored account ids to Atlassian's personal data reporting API at least every 7 days. For accounts reported as closed, jobs are erased and templates and rules are anonymised.
Permissions
Every permission the app requests, and why. The scopes are granular unless the table says otherwise.
| Scope | Why the app needs it |
|---|---|
storage:app | Forge storage on your site for jobs, templates and rules |
read:page:confluence | Read the page tree and page bodies to plan, copy and rewrite |
write:page:confluence | Create the copies and save the rewritten bodies |
read:hierarchical-content:confluence | List the descendants of a page |
read:content.metadata:confluence | Ancestors of a page, and the progress of Confluence's own copy task |
read:content-details:confluence | Copy a single page, search titles to detect conflicts, read page restrictions |
read:space:confluence | Space picker, and the check that you may create pages in the destination |
write:content.restriction:confluence | Copy page restrictions to the copies and apply inherited edit restrictions |
read:confluence-content.summary | Required by Atlassian to receive page created, moved and copied events for the optional rule |
report:personal-data | Report stored account ids to Atlassian's personal data reporting API |
Offline user impersonation (allowImpersonation) is enabled on the seven granular Confluence scopes above, not on the classic event scope. Copy jobs and the rule trigger run in the background after the user has left the page. They act as the user who started the job or made the change, so that user's own Confluence permissions decide what can be copied or changed. Otherwise the app never uses broader permissions than the user has. The one exception is the optional rule: if Atlassian cannot act as the person who made a change (for example a deactivated account), the app uses its own identity to read the rule and to apply the restrictions of the page the rule belongs to. There are no delete scopes, no user scopes and no admin scopes.
Access control
Every Confluence request is made with the identity of the user, apart from the one case described under Permissions. Jobs belong to the user who started them. Templates and rules are shared: any licensed user of the app can see, change or delete them. Copy requests are validated for shape and size on the server, and the license is checked on the server for every feature.
Logging
Error class and message with page ids only. Page content, titles of restricted pages and template values are not logged.
Encryption
Data in transit and at rest is protected by the Atlassian Forge platform. The app has no database or storage outside Forge.
Sub-processors
None besides Atlassian.
AI and language models
None. The app does not use Forge LLM and sends no content to any model.
Vulnerabilities and incidents
We fix vulnerabilities within the windows Atlassian requires of Marketplace apps (critical: 10 days, high: 4 weeks, medium: 12 weeks, low: 25 weeks) and tell Atlassian about security incidents within 48 hours. Dependencies are checked for known vulnerabilities before each release.
Report a vulnerability to support@karelialabs.atlassian.net. Please include what you found, how to reproduce it and which app and version are affected, and give us a reasonable time to fix it before you publish details.
Deleting data
Uninstalling the app removes it from your site, and Atlassian then deletes its stored data under its Forge data retention rules. Users can delete templates, rules and finished jobs in the app. Accounts that Atlassian reports as closed are erased as described above.