Security Statement for Doc Review Manager

Isolated Execution Environment:

• Runs in Atlassian's secure, sandboxed environment
• No direct server access or infrastructure management required
• Automatic security patches and updates from Atlassian

Secure by Default:

• OAuth 2.0 authentication handled by Atlassian
• No credential storage in app code
• All API requests authenticated via Forge framework
• Automatic HTTPS/TLS encryption for all communications

Platform Compliance:

• SOC 2 Type II certified infrastructure
• ISO 27001 certified
• GDPR compliant
• Regular security audits by Atlassian

Data Storage:

• All data stored within your Atlassian Cloud instance
• Uses Confluence Content Properties API (page-specific data)
• Uses Forge Storage API (application settings)
• No external databases or storage systems
• Data encrypted at rest by Atlassian Cloud

Data Transmission:

• All API calls use HTTPS/TLS 1.2+
• No data transmitted outside Atlassian infrastructure
• Only communicates with *.atlassian.com domains
• No third-party API integrations

Data Access:

• Respects Confluence permission model
• Users only see data they have permission to access
• Admin features restricted to Confluence administrators
• No backdoor access or privileged accounts

Secure Development:

• Modern React 18 and Forge UI Kit 2
• No deprecated dependencies
• Regular dependency updates
• Code follows Atlassian security guidelines

Input Validation:

• All user inputs validated using Zod schemas
• Type-safe TypeScript interfaces
• Protection against injection attacks
• Sanitized data storage and retrieval

Error Handling:

• Errors logged without exposing sensitive information
• User-friendly error messages without security details
• Retry logic with exponential backoff (prevents abuse)
• Graceful degradation on failures

API Security:

• Minimum required permission scopes
• Scope-based access control
• No overly broad permissions requested
• Regular permission audits

Page-Level Data (Content Properties):

• Review schedule configuration (interval, unit)
• Next review date (ISO 8601 timestamp)
• Review owner (Atlassian account ID only)
• Review history (max 10 entries: dates, reviewer IDs, versions)
• Reminder tracking (dates and types of reminders sent)

Application-Level Data (Forge Storage):

• Global reminder settings (thresholds, enabled status)
• Default review interval preferences
• Job execution statistics (timestamps, counts)

Dependency Management:

• Regular updates to npm packages
• Automated dependency vulnerability scanning
• Prompt patching of known vulnerabilities
• Use of stable, maintained libraries only

Forge Platform Updates:

• Automatic platform security patches from Atlassian
• Runtime environment automatically updated
• No infrastructure maintenance required

Please Report To:

• Email: support@petabyte.de
• Subject: "Security Vulnerability - Doc Review Manager"

Please Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes (optional)

Our Commitment:

• Acknowledge receipt within 48 hours
• Investigate and respond within 5 business days
• Fix critical vulnerabilities within 30 days
• Provide updates on resolution progress

Responsible Disclosure:

• Please allow us reasonable time to fix issues before public disclosure
• We will credit security researchers (with permission)
• No legal action for good-faith security research

Detection:

• Monitor app errors and anomalies
• Review Atlassian security advisories
• Track dependency vulnerabilities

Response:

1. Assess scope and impact
2. Contain the incident
3. Notify affected users (if applicable)
4. Implement fixes
5. Deploy updates
6. Conduct post-incident review

Notification:

• Critical incidents: Notify within 24 hours
• Major incidents: Notify within 72 hours
• Updates posted to Marketplace listing
• Direct communication for data breaches

Installation:

• ✅ Install only from official Atlassian Marketplace
• ✅ Review permissions before installation
• ✅ Test in non-production environment first
• ✅ Review security and privacy documentation

Configuration:

• ✅ Grant access only to authorized users
• ✅ Regularly review reminder settings
• ✅ Monitor job execution statistics
• ✅ Remove app if no longer needed

Monitoring:

• ✅ Review Confluence audit logs regularly
• ✅ Monitor app update notifications
• ✅ Check for unusual reminder activity
• ✅ Verify reminder comments are legitimate

For Page Owners:

• Only enable review tracking on appropriate pages
• Set reasonable review intervals
• Confirm reviews only when actually completed
• Report suspicious reminder comments

For Administrators:

• Use Confluence permissions to control dashboard access
• Regularly review tracked documents
• Remove tracking from archived/obsolete pages
• Keep global settings current

Automated:

• npm audit for dependency vulnerabilities
• Forge lint for code quality and security
• Atlassian platform security monitoring

Manual:

• Code review before releases
• Permission scope audits
• API usage pattern reviews
• Error log analysis

Confluence Audit Logs:

• Forge function invocations logged
• API calls recorded by Atlassian
• User actions tracked in Confluence audit log
• Admin configuration changes visible

App-Specific Logging:

• Job execution timestamps
• Reminder sending events
• Error occurrences (without sensitive data)

For security issues:

• Email: support@petabyte.de
• Response Time: 48 hours for acknowledgment

For general support:

• Email: support@petabyte.de
• Marketplace: https://marketplace.atlassian.com/vendors/413302290/

What We Control:

• App code and logic
• Permission scope requests
• Data storage patterns
• Update deployment

What Atlassian Controls:

• Platform infrastructure security
• Data encryption at rest
• Network security
• Authentication and authorization
• Data center physical security
• SOC 2 / ISO compliance

Atlassian Security:

• Forge Security
• Trust Center
• Security Practices

App Documentation:

• Privacy Policy