Security & data handling
Last updated: 1 November 2026
| Question | Answer |
|---|---|
| Hosting | Atlassian Forge only. |
| External network calls (egress) | None. The app manifest declares no external permissions. |
| Data stored by the app | Forge storage only: the saved daily rule, job progress (space IDs), and summaries of the last 30 runs (counts; space IDs with action and reason). No names, no space keys, no content. |
| Data stored outside Atlassian | None. |
| Scopes | read:space:confluence (list personal spaces), read:page:confluence and read:blogpost:confluence
(count content, last change), read:attachment:confluence, read:comment:confluence and
read:hierarchical-content:confluence (the "untouched" check: attachments, comments, whiteboards and other items),
write:confluence-space (archive and restore spaces), read:confluence-user (administrator check and owner account
status), storage:app (rule settings and run history). |
| Who can use it | Confluence administrators only. The page lives in Confluence administration, and every request is checked on the server: the user's account (from Atlassian's request context) must have the Confluence "administer" permission. |
| Who the app acts as | The app (Forge app user), so the daily rule can run without a browser. Only administrators can start jobs or save the rule. |
| Safety rails | Archives only, never deletes; dry run by default; typed ARCHIVE confirmation; every space is read again
before it is changed and only personal spaces are ever changed; one job at a time; daily rule needs at least 1 day; every run can be undone. |
| Audit trail | The app's history lists the last 30 runs with a report. Confluence's audit log records space archiving as well. |
| Personal data | None stored. Owner names and account status are read from Confluence in memory and shown only to the administrator. |
| Data residency | Forge storage follows Atlassian's data residency for Forge apps on your site. |
| Analytics and tracking | None. |
| Sub-processors | None besides Atlassian, which hosts Confluence and Forge. |
| Vulnerability reports | Email vacancy@kenanislamoglu.com with the subject "Security". We acknowledge within 2 business days. |