App Limitations
Compliance Glossary is a terminology management and compliance scanning tool for Confluence, not a full QMS or e-signature platform. It records Atlassian account IDs, not cryptographic signatures. CSV import is capped at 500 terms per file. Exports include CSV, JSON baselines, and a print-to-PDF evidence package. Term matching uses exact word boundaries, with no fuzzy matching. The app has read-only Confluence access and never modifies your pages.
Fit gate: use Compliance Glossary when Confluence pages contain terms that must be approved, current, scanned, and exportable as evidence. It is not for general glossary browsing, translation management, or page approval alone.
Last Updated: 13 October 2026 (v6.2.0) · Code references verified against source on 2026-10-13 at commit cc85543 (app/src/)
We believe in transparency. This page documents every known limitation, platform constraint, and compliance boundary. Each limit has been verified against the actual source code. For a positive view of what we do cover, see our compliance guide mapping features to real regulatory standards.
Platform Limits (Atlassian Forge)
| Limit | Value | Notes |
|---|---|---|
| Function timeout | Platform-dependent | Forge invocation limits vary by function type and can change. The app uses bounded batches; duration is not guaranteed. See Atlassian Forge invocation limits (checked 6 August 2026). |
| Runtime memory | 256 MB | Per function invocation. |
| Entity size | 240 KB per entity | Atlassian Forge KVS platform limit per entity value. We cap scan-result findings at 48 KB (shared/kvs-helpers.js:452, MAX_FINDINGS = 120 at ~320 bytes/finding) and chunk the term cache at 200 entries per entity (shared/kvs-helpers.js:12, CACHE_CHUNK_SIZE = 200) to stay well under this. |
| KVS query page size | 100 results per call | Forge KVS getMany() max page size. All queries use cursor pagination (shared/kvs-helpers.js:114, queryByField) — no data silently dropped. |
| Confluence access | Read-only | The app never creates, modifies, or deletes your Confluence pages. |
Scanning
The scanner uses a map-reduce architecture for large spaces. Estimated scan times (estimates, not measured production results):
| Space Size | Estimated Time | Notes |
|---|---|---|
| Under 200 pages | < 10 seconds | Single batch, near-instant. |
| 200 – 1,000 pages | 30 – 60 seconds | Multiple chunks with progress bar. |
| 1,000 – 5,000 pages | 2 – 5 minutes | Typical enterprise space. Fully supported. |
| 5,000+ pages | 5 – 15 minutes | Large enterprise. Progress bar shows real-time status. |
| Limit | Value | Impact |
|---|---|---|
| Pages per space scan | 200,000-page input ceiling | A code limit, not measured production capacity — see scale limits. Map-reduce architecture with paginated indexing. Indexing and scan loops run from the browser — the scanner tab must stay open until the scan completes. Progress bar shows real-time status. |
| Term matching | Exact word-boundary | Matches whole words only. "AE" will not match "AEs", "adverse" will not match "adversely". |
| Auto-scan triggers | Create & update only | Page deletions, moves, and renames do not trigger a scan. |
| Scan history | Append-only snapshots | Each scan writes a snapshot alongside the latest result. Full scan history per page and per space. |
| Index chunk | 5,000 pages per resolver invocation | Each resolver call fetches up to 5,000 page IDs via 20 Confluence API calls (250 pages each). Frontend loops resolver until complete. (resolvers/scan.js:22, INDEX_CHUNK = 5000; resolvers/scan.js:244-245, limit=250) |
| Page-scan batch | 8 pages in parallel | Pages fetched concurrently per batch to stay under Confluence 10 req/s API rate limit. (resolvers/scan.js:277, BATCH = 8) |
| Context snippet | 80 characters | 40 characters before and after each match. (helpers.js:109, helpers.js:121) |
Import & Export
| Limit | Value | Workaround |
|---|---|---|
| CSV import cap | 500 terms per file | Hard cap (resolvers/terms.js:543). Terms written 10 in parallel per batch (resolvers/terms.js:483, IMPORT_BATCH = 10) — 20 KVS req/burst, safe under Forge KVS 40 req/s limit. Split larger files. |
| Import status | All start as Draft | Imported terms must go through the approval workflow. |
| Export format | CSV, JSON, print-to-PDF | CSV exports; baseline packages as JSON and CSV; an Audit Evidence Package saved as PDF via browser print; a content-addressed evidence archive. XML export is not available. |
| Export generation | Browser-side | Large glossaries (1000+ terms) may take several seconds to compile. |
Workflow
- No skip-state transitions: Terms must follow Draft → Review → Approved. You cannot go directly from Draft to Approved.
- Approved terms cannot be deleted: Must be deprecated first.
- Single space per term: Each term belongs to one space or "ALL". Multi-space assignment is not supported.
- Stale threshold: Fixed at 180 days (6 months). Not configurable per category. (
shared/kvs-helpers.js:641) - No undo/revert: Full version history is visible but there is no "revert to version N" action.
- Duplicate check on create only: Renaming an existing term does not check for name collisions.
Compliance Scope — What We Do and Don't Cover
This is a terminology management and compliance scanning tool. It is not a full QMS, e-signature platform, regulatory submission system, general glossary browser, translation-management system, or standalone page-approval workflow. Teams use it for FDA 21 CFR Part 11 terminology, SOC 2 audit readiness, and EU AI Act compliance within this scope.
| Capability | Status | Details |
|---|---|---|
| Append-only audit trail | Yes | Every action recorded with user ID, timestamp, and change reason. |
| Four-eyes approval | Yes | Checks creator, submitter, and last editor. Another user must approve. |
| Mandatory change justification | Yes | Required on edits, status changes, and bulk operations. Not required on initial term creation. |
| E-signatures | No | Uses Atlassian account IDs, not cryptographic signatures (Part 11 Subpart C). |
| Role-based access (in-app) | Yes | Opt-in RBAC: designate term managers who can create, edit, approve, and delete. Others get read-only. |
| Finding resolution workflow | Yes | Findings can be acknowledged, justified (with reason), or closed. Full resolution audit trail per page-term pair. |
| Global activity log | Yes | Chronological view of all actions across all terms. Per-term history also available. |
| Compliance score | Basic | Single dimension (% approved). Does not factor review freshness or metadata completeness. |
| Webhooks / notifications | No | No email or Slack alerts on status changes. The only external integration is the optional, administrator-enabled GitHub connector. |
| Multi-language UI | No | English only. Term content can be any language. |
What We Honestly Claim
| Our Claim | Honest? | Caveat |
|---|---|---|
| "Append-only audit trail" | Yes | Deletions write a final audit entry before removal. |
| "Four-eyes approval" | Yes | Checks 3 fields: createdBy, submittedBy, updatedBy. |
| "No DailyMind-operated app servers" | Yes | Runs on Atlassian Forge. The only external egress is an optional, administrator-enabled GitHub connector that calls https://api.github.com. AI-assisted curation uses Atlassian-hosted Forge LLM. See the privacy policy. |
| "Mandatory change justification" | Yes | Enforced on edits, status changes, and bulk operations. Only gap: initial term creation. |
| "Supports ALCOA+" | Partial | Supports ALCOA+ principles for terminology records, including "Complete" (bulk ops include change reasons). It does not certify data integrity on its own. |
| "Compliance scanner" | Yes | Exact match only. Up to the 200,000-page input ceiling, a code limit, not measured capacity (map-reduce). No fuzzy matching. |
| "Finding resolution" | Yes | Acknowledge, justify, or close findings. Full resolution audit trail per page-term pair. |
| "Role-based access" | Yes | Opt-in term managers. Backend-enforced on all write resolvers. |
| "Scan history" | Yes | Append-only snapshots. Records scan state at each scan time. |
| "Display names" | Yes | Real names from Confluence API with graceful fallback to truncated account ID. |
Questions about limitations? Contact [email protected].
Related reading
- Compliance for Confluence — approved terms, page scanning, and audit evidence for regulated teams in Confluence
- Security whitepaper — Forge architecture, SOC 2 / DORA / NIS2 / GDPR / FDA 21 CFR Part 11 mapping
- Compliance guide — how features map to real regulatory standards
- How it works — architecture and data flow overview
- Changelog — release history and version notes