The Atlassian apps
Treewright, Specfold, Q&A Knowledge Base and the Word and PDF Document Generator are built only on Atlassian Forge, and each is eligible for Atlassian's Runs on Atlassian program (checked on 14 October 2026).
- No outside servers. The apps declare no outbound network access, no remotes, no external backend, no analytics and no third-party service.
- Data stays in Atlassian. Anything an app stores is in Forge storage on your site, or in Confluence and Jira themselves. Forge storage follows the data residency of the host product (your Confluence or Jira site). Atlassian runs Forge functions on its own infrastructure and aims to run them in the same region.
- Acting as you. Requests to Confluence and Jira are made with the permissions of the person using the app, so the product's own permissions decide what is possible. Background work runs as the user who started it. The product pages name the few exceptions.
- Few, explained permissions. Scopes are granular, and each one is explained on the app's security page. Treewright also needs one classic scope, which Confluence requires for page events.
- Licenses are checked on the server. Apps fail closed in production when a license is missing.
- Personal data reporting. Apps that store Atlassian account ids take part in Atlassian's personal data reporting and erase data of accounts that Atlassian reports as closed.
- No sub-processors, no AI of our own. We use no sub-processors for customer data besides Atlassian, and the apps contain no language model. Q&A Knowledge Base has an optional Rovo action that hands search results to Atlassian's Rovo if you use it.
Compared at a glance
| Product | What it stores | Personal data | Permissions |
|---|---|---|---|
| Treewright | Jobs, reports, templates and rules in Forge storage | Atlassian account ids | 7 granular Confluence scopes and 1 classic scope for page events, plus Forge storage and personal data reporting |
| Specfold | Nothing | None | 1 read scope, for attachments |
| Q&A Knowledge Base | Votes, tags, watches, inbox and settings in Forge storage. Posts in Confluence | Atlassian account ids and group names | 10 granular Confluence scopes, plus Forge storage and personal data reporting |
| Word and PDF Document Generator | Templates and job records in Forge storage | Account ids. For job owners also name and email, for 14 days | 25 granular Jira scopes, plus Forge storage and personal data reporting |
None of the Atlassian apps makes calls to outside servers.
Karelia Translate for Flarum
Karelia Translate runs on your own Flarum server. It sends the text of a post only to the translation service you choose, only when a reader asks, and never contacts us.
- Your server. Everything it stores (the language of each post, saved translations, settings and monthly usage) is in your own Flarum database. It has no telemetry, no analytics and no license server.
- Only the service you choose. Post text goes to the translation service you configure, with your own key, and only when a reader asks. Code, web addresses and @mentions are replaced by placeholders first. With a local model or LibreTranslate, nothing leaves your server.
- Flarum permissions. A reader can only translate posts they can see, and only with the Translate posts permission. Settings and the connection test are for administrators.
- Keys out of the database if you want. Environment variables win over the stored setting.
The security page of Karelia Translate has the full list.
Vulnerabilities and incidents
We fix vulnerabilities within the windows Atlassian requires of Marketplace apps (critical: 10 days, high: 4 weeks, medium: 12 weeks, low: 25 weeks) and tell Atlassian about security incidents within 48 hours. Dependencies are checked for known vulnerabilities before each release.
We aim for the same time limits for Karelia Translate, Karelia Trash, Karelia Spreadsheet, Karelia Conversions, Karelia Tickets.
Report a vulnerability to support@karelialabs.atlassian.net, or use the contact in our security.txt. Please include what you found, how to reproduce it and which app and version are affected. Give us a reasonable time to fix it before you publish details, and do not access data that is not yours.