Definitive GlossaryThis policy describes how the Definitive Glossary app for Confluence Cloud ("the app") protects your data, and how to report a security problem. The app is provided by e360 ("we", "us"). How the app handles personal data is covered in the privacy policy.
Summary
- The app runs entirely on Atlassian's Forge platform and is eligible for Atlassian's Runs on Atlassian program.
- It makes no network requests outside Atlassian. We run no servers of our own, and we cannot access your data.
- It asks only for the permissions it needs, and acts as the signed-in user, so your Confluence permissions apply.
Hosting and infrastructure
The app's code runs in Atlassian's Forge functions, and its data is kept in Atlassian's Forge hosted storage, tied to your site's installation of the app. Atlassian operates, secures and monitors that infrastructure; see the Atlassian Trust Center for its controls and certifications. The app declares no external domains, remote back ends or web triggers, so there is no route for data to leave Atlassian.
Data the app handles
- Glossary content your users enter: terms, aliases, definitions, status, space scope, source links and review dates, with each term's change history and an audit log.
- Atlassian account IDs of term owners, glossary editors and people who change terms. No names, email addresses or passwords are stored.
- Settings and job status: glossary editors, linking options, reminder settings and the progress of bulk-linking jobs.
- Page content is read only while terms are being linked or unlinked on a page, and is not stored by the app.
The app's data is stored within Atlassian. The app does not yet support choosing a data residency location.
Access control
- Least privilege. The app requests only the Confluence permissions its features need: reading and updating pages and blog posts (to add and remove glossary links), reading spaces, users and content permissions (to respect who can see and edit what), app storage, and Atlassian's personal data reporting.
- Your permissions apply. Page actions run as the person using them, so they can only change pages they can edit. A bulk job for a whole space checks, page by page, that the person who started it can edit the page.
- Space terms stay in their space. Terms that belong to a space are only shown to people who can see that space.
- Governed changes. Only the glossary editors you choose can approve, deprecate or delete terms. Only Confluence administrators can change the app's settings, and this is checked on the server. Every change to a term is recorded in its history and in the audit log.
Authentication
Atlassian handles sign-in. The app has no accounts or passwords of its own, and never asks for API tokens or personal access tokens.
Logging
The app's logs, kept in Atlassian's Forge platform, record errors only. They don't contain glossary content or personal data.
Secure development
- Every release is checked by automated end-to-end tests on a test site, covering permissions, data handling and page changes.
- Test-only code is removed from production builds, and each production build is checked for Runs on Atlassian eligibility.
- Dependencies come from the npm registry, are kept up to date and are checked for known vulnerabilities.
- We follow Atlassian's security requirements for cloud apps.
Reporting a vulnerability
If you find a security problem in the app, email support@definitiveglossary.com with "Security" in the subject. Please include the steps to reproduce it and don't share the details publicly until it's fixed. We acknowledge reports within one business day, keep you updated, and fix confirmed issues within the timeframes Atlassian sets for Marketplace apps.
Security incidents
If a security incident affects your data, we will notify you and Atlassian without undue delay, explain what happened and what we are doing about it, and follow up when it's resolved.
Retention and deletion
Glossary data is kept while the app is installed. Admins can export it to CSV and delete terms at any time. When the app is uninstalled, Atlassian handles the app's stored data under its Forge data retention policies. Weekly, the app reports stored account IDs to Atlassian and erases closed accounts from everything it stores.
Contact
Security contact: support@definitiveglossary.com