🔒 Trust Center Navigation

Trust Center

Legal Documents

← Back to Documentation

Security Overview

Community Questions is an Atlassian Forge app for Confluence Cloud with a remote backend hosted on Microsoft Azure. This page describes its current security controls and where app data is processed and stored.

Hosting & Infrastructure

  • The remote backend and primary Azure SQL database are hosted in Azure's West Europe region. The app interface runs within Confluence using Forge Custom UI.
  • Production and development use separate Azure resource groups, SQL servers, Key Vaults, and telemetry resources.
  • Azure SQL transparent data encryption protects app-hosted database records at rest. Automated backups provide a seven-day point-in-time recovery window; backup storage is geo-redundant.
  • The database uses a public endpoint restricted by IP firewall rules for application and permitted administrative or development access.
  • Runtime secrets are loaded from Azure Key Vault. The production backend uses an Azure managed identity to authenticate to Key Vault.
  • The production backend requires HTTPS with TLS 1.2 or later. Azure SQL also requires TLS 1.2 or later.

Authentication & Permissions

People sign in with their Atlassian accounts; Community Questions does not store their Confluence passwords.

Requests through Forge Remote use signed Forge Invocation Tokens tied to the verified Confluence installation. Confluence operations use scoped Forge app or user authorization appropriate to the action and remain within the installation's approved permissions.

Access depends on Confluence space access and the relevant app permissions for Questions, Answers, Votes and Tags. The backend checks the current person's Votes View permission before reading SQL-backed votes. Adding or removing a vote requires Votes View, Add and Delete, plus access to the question or answer. Comments and attachments use their separate Confluence permissions.

The app account has its own permissions. Giving access to the app account does not give that access to people. See the Permissions guide for configuration and troubleshooting.

Data Handling & Residency

Question and answer bodies, attachments and mirrored question pages are stored in Confluence. The remote backend processes content and user information when providing app features, search and notifications. Recent-search database records contain Confluence content IDs rather than copies of question or answer bodies. App and space configuration is also stored in Confluence app and space properties.

The Azure SQL database stores app records such as:

  • Tenant and installation mappings, operational settings and cached Forge app access tokens.
  • Vote records, Atlassian account IDs and metadata used to calculate reputation.
  • Integration configuration, workspace and channel IDs and credentials.
  • Confluence content IDs used for recent searches and notification personal-data reporting records.

Vote and profile records use Atlassian account IDs. Names and email addresses are retrieved from Confluence when features such as notifications need them.

The primary app-hosted database is in Azure's West Europe region. App-hosted data does not automatically move when you change Atlassian Cloud data residency. The Forge remote declares its stored data as in-scope End-User Data. This does not mean all processing stays inside Atlassian or the EU: notifications and optional integrations involve the providers described below.

Integrations & Notifications

Slack uses OAuth 2.0 authorization, requesting permissions to post messages and read workspace and public-channel information. Microsoft Teams and Google Chat use webhook URLs. Webhook configuration requires HTTPS and validates URLs against the supported provider hosts before saving.

The app encrypts Slack bot access tokens and Teams/Google Chat webhook URLs using AES-256-GCM when saving them to the database or Confluence integration properties. Cached Forge app access tokens are stored in Azure SQL, which has transparent data encryption enabled.

Chat notifications send question titles and Confluence links to the configured destination. Access to those messages follows the destination channel's permissions. Opening linked Confluence content still requires Confluence access.

Email notifications use Twilio SendGrid. Depending on the notification, the provider receives recipient email addresses and names, contributor names, question titles, space or tag names, and Confluence links. In-app feedback also uses SendGrid and includes the submitted text and contact email when contact is allowed.

Removing a connection in Community Questions removes its stored configuration. Customer-owned credentials can also be revoked through the relevant provider. Previously delivered messages remain subject to that provider's retention and access controls.

Logging & Safeguards

Application Insights provides backend diagnostics, and Sentry captures frontend errors. Diagnostic records can contain Atlassian account IDs, Confluence cloud IDs and content IDs, request routes and error details. Backend error diagnostics may include portions of provider responses or user-supplied text. Logging and telemetry redact recognized credentials and sanitize URL query strings, credentials embedded in URLs and URL fragments.

Configured Azure Monitor alerts cover service availability, exception anomalies and missed personal-data reporting.

Submitted text and structured document content are rendered with controls intended to prevent script injection. Backend-hosted pages restrict script execution, and Forge controls the content policy for its interface embedded in Confluence.

Requests validate Confluence content IDs and space IDs used for votes and recent searches, telemetry information and notification destinations. Search and link values are encoded, attachment filenames are handled safely in responses, and app-managed database queries use structured values.

Privacy, Export & Deletion

Individual SQL vote records are stored separately from Confluence content and are not included by the app in Confluence content exports. Contact support about app-managed data export or migration.

On a Confluence deleted-user event, the app removes the user's SQL profile references and replaces their individual votes with unattributed counts, preserving public vote totals.

A verified Forge uninstall stops access and clears the stored app token. App-hosted tenant data is kept for 30 days, then deleted at the next daily cleanup. Reinstalling on the same Confluence site during this period recovers retained data after fresh authorization and cancels deletion.

Backups have a separate seven-day recovery window. Backup files can remain longer to support this recovery window. Limited installation IDs, installation times and site details remain without a fixed expiry to recognize the installation and deny old authorization. Verified return or erasure requests follow the DPA.

The app reports notification-related personal-data usage to Atlassian. Its notification usage observations expire one calendar year after each send; bare account and reporting-status records remain. Reporting does not erase SendGrid history or messages already delivered to recipients. Contact support for questions about deletion or retained app data.

Our Privacy Policy and Data Processing Agreement describe the applicable data-protection terms.

Vulnerability Reporting

Report suspected vulnerabilities to support@communityquestions.io, including a description, reproduction steps and potential impact. We aim to respond within 48 hours.