Security Policy

Compliance Glossary for Confluence runs on Atlassian Forge. We do not operate app servers, databases, or cloud services for app data. Its only external egress is an optional, administrator-enabled GitHub connector that calls https://api.github.com. AI-assisted curation uses Atlassian-hosted Forge LLM and starts only when an administrator selects findings.

Compliance Glossary runs on Atlassian Forge. DailyMind LTD operates no app servers. Its only external egress is an optional, administrator-enabled GitHub connector. The app reads Confluence pages only to scan them and never modifies them. Its audit trail records Atlassian account IDs. Data is encrypted at rest by Atlassian and in transit with TLS. Report vulnerabilities to [email protected]; we aim to acknowledge within 3 business days.

Last Updated: 13 October 2026 · Last Verified: 13 October 2026

1. Overview

The app is built on Atlassian Forge, Atlassian's cloud app development platform.

2. Infrastructure Security

The App's infrastructure security is provided by the Atlassian Forge platform:

• Sandboxed execution — App code runs in Atlassian's Forge sandbox (Node.js runtime declared in our manifest), isolated from other apps and customer environments. The sandbox restricts network access, file system access, and available APIs.
• Data encryption at rest — All data in the Forge Entity Store is encrypted at rest by Atlassian. Encryption key management is handled by Atlassian's infrastructure.
• Data encryption in transit — All communication between the App and the Atlassian platform uses TLS encryption.
• Data isolation — Each Atlassian installation has its own isolated data partition in the Forge Entity Store. No installation can access another's data.
• No DailyMind-operated infrastructure — We do not run servers, databases, or services that the App connects to. When an administrator enables the GitHub connector, the App calls https://api.github.com and accepts signed GitHub webhook metadata through a Forge web trigger.

Atlassian maintains SOC 2, ISO 27001, and other certifications for their cloud infrastructure. Details are available in Atlassian's Trust Center.

3. Authentication & Access Control

The App uses Forge's built-in authentication mechanisms exclusively:

• Forge auth — The App authenticates using api.asApp() and api.asUser() provided by the Forge platform. No personal access tokens or passwords are used or stored. If an administrator enables the GitHub connector, its GitHub App private key and webhook secret are kept in Forge Secure Storage; short-lived installation tokens stay in invocation memory.
• Role-based access — The App enforces role-based access control. Administrative actions (managing glossary terms, configuring settings, managing access control lists) are restricted to users with appropriate Confluence permissions or app-level admin roles.
• Four-eyes approval workflow — Glossary terms go through a review and approval workflow. A term cannot be approved by the same person who submitted it for review, enforcing separation of duties as required by regulatory frameworks.
• No credential storage — The App does not store any user credentials. Authentication is fully delegated to the Atlassian platform.

4. Data Protection

• Storage — Core records are stored in Forge KVS (Entity Store). Enterprise evidence uses Forge SQL and Forge Object Store. DailyMind operates no app databases.
• One optional external egress — The manifest allows backend fetch only to https://api.github.com, for the optional GitHub connector. It is off until an administrator enables it with a customer-provided GitHub App installation. Because of this egress, production v6 is not eligible for Runs on Atlassian.
• Read-only Confluence access — The App reads Confluence page content solely for compliance scanning purposes. It does not modify, delete, or create Confluence pages. Scans persist findings, not page bodies. A baseline freeze is the exception: it stores the exact scanned revision as evidence in Forge Object Store.
• Minimal personal data — The App's audit trail records Atlassian account IDs, not names, email addresses or other profile information. Other personal data is stored only where you include it in terms, pages, uploads or GitHub content (see the DPA). Account IDs are used to maintain the regulatory audit trail required by frameworks such as 21 CFR Part 11 and ISO 13485.
• Export security — Export data is read by the App's Forge resolvers inside Atlassian's runtime, and the CSV file is assembled in the user's browser. No DailyMind server is involved.

AI-assisted curation (available since v5.0): it uses Atlassian-hosted Forge LLM, not a DailyMind model endpoint. Curation starts only when an administrator selects undefined-term findings, creates drafts only, and still requires four-eyes approval. Approved-term usage classification also uses Forge LLM. Data boundaries are in the privacy policy (§3.5).

5. Code Security

• Forge security review — All Forge apps undergo Atlassian's security review process before being listed on the Atlassian Marketplace. This includes static analysis and review of requested permissions and scopes.
• Permission-scoped execution — The Forge runtime restricts the App's capabilities to declared permissions only. The App cannot access the file system, spawn processes, or make arbitrary network connections.
• No external dependencies for data processing — The App does not rely on external libraries or services for processing customer data. Scan matching runs within the App's own codebase inside the Forge sandbox. Approved-term usage classification and AI-assisted curation use Atlassian-hosted Forge LLM.
• Source control — Source code is managed in private repositories with access restricted to the development team.

6. Vulnerability Reporting

We take security vulnerabilities seriously. If you discover a security issue in Compliance Glossary for Confluence, please report it responsibly:

• Email: [email protected]
• What to include: a description of the vulnerability, steps to reproduce, and the potential impact
• What to expect: we aim to acknowledge within 3 business days and provide an initial assessment within 10 business days

Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it. We will not take legal action against researchers who report vulnerabilities in good faith.

7. Incident Response

In the event of a security incident affecting the App:

• We will investigate the scope and impact of the incident promptly
• Affected customers will be notified through their Atlassian site administrator contact and via the Atlassian Marketplace listing
• We will provide a clear description of what happened, what data was affected, and what remediation steps are being taken
• A post-incident summary will be made available once the issue is resolved

For incidents related to the underlying Atlassian Forge platform or infrastructure, Atlassian's own incident response process applies. See Atlassian's Security Incident Management.

8. Compliance

• GDPR — DailyMind LTD acts as a data processor for personal data stored through the App. The App's audit trail records Atlassian account IDs; other personal data is stored only where customers include it in content. No special categories of personal data are processed. For data we process on our own behalf (e.g., support correspondence, website analytics), we act as controller. See our Privacy Policy and DPA for the full allocation of roles.
• Personal data reporting — The App implements Atlassian's Personal Data Reporting API, reporting all stored account IDs to the Atlassian platform on a weekly cycle.
• Right to erasure — When Atlassian signals that a user account has been closed, the App automatically anonymizes all references to that account ID across glossary terms, version history, finding resolutions, and access control lists.
• Data deletion on uninstall — When the App is uninstalled, all per-installation data in the Forge hosted storage is soft-deleted by Atlassian and then permanently deleted in line with Atlassian's Standard Data Retention and Disposal policy (documented in Atlassian's SOC 2 report). See Atlassian's Data lifecycle for Forge-hosted storage.
• No cookies or client-side tracking — The App itself does not use cookies, local storage, or any client-side tracking mechanisms.

For full details on data handling, see our Privacy Policy.

9. Insurance

The company carries no Professional Indemnity or Cyber Liability policy today — this is disclosed up front so procurement teams can decide whether that fits their risk threshold. Once cover is bound, the certificate of insurance will be available on request.

10. Contact

For security-related inquiries: [email protected]

For general questions: [email protected]

DailyMind LTD
Limassol, Cyprus

Compliance for Confluence

See how Compliance for Confluence turns approved terminology into audit evidence inside Confluence.