Since 2009
TELCOMA Global / Secret & Personal Data Scanner for Confluence / Privacy policy
What the app reads, what it keeps, and what it never changes.
This policy describes what Secret & Personal Data Scanner for Confluence does with your data.
1
What the app is
Secret & Personal Data Scanner for Confluence ("the app") is an Atlassian Marketplace app that shows a Confluence Cloud administrator where passwords, keys and personal data have been written into pages and blog posts, so they can be removed. It runs entirely on Atlassian's Forge platform and is read-only.
2
What data the app processes
The app reads the following from your Confluence Cloud site, using the permissions granted at installation:
- Spaces: the list of spaces, and each space's ID, key and name.
- Pages and blog posts: the current version of each page and blog post, with its title, its text, its version number, the account ID of the person who last edited it and when. The text is read in memory to check it against the app's rules and is then dropped. By its nature, that text may contain secrets and personal data; finding them is the purpose of the app.
- Page events: when a page or blog post is created, edited or restored from the trash, or a page is moved, Confluence tells the app which one, so it can scan it again.
- Access checks: whether the person using the app is a Confluence administrator, and whether they can open a given page or blog post. For the second check the app reads only whether Confluence says yes or no.
- User directory data: the display names of the people who last edited a page, marked a finding or started a scan, when the admin page is displayed and in the export an administrator downloads. Names are not written to storage.
The app does not read comments, attachments, older page versions, drafts, archived pages, whiteboards or databases.
3
What the app changes
Nothing. The app has no write permission. It cannot change, move or delete pages, blog posts, page history, spaces or any setting.
4
What data the app stores
The app stores, in Forge's Atlassian-hosted storage within your site's data residency region:
- A random key, made once for your site and kept as a Forge secret, used to make the keyed hashes below.
- For each page or blog post with findings: its ID, type, space ID, version, title with any found value masked, the last editor's account ID, when it was edited and when it was scanned. For each finding (at most 200 per page): its type, the value masked to its first and last 2 characters (fully masked for values under 10 characters), the line around it with every value on that line masked, the line number, how many times it appears, and a keyed hash (HMAC-SHA256) of the value. The hash lets the app recognise the same value on the next scan. It cannot be turned back into the value.
- Each Resolved or False positive mark: the status, the account ID of the admin who set it, and when.
- Each space's key and name.
- Scan progress (position, counters, warnings, who started the scan as an account ID, and timestamps), and the summary of the last 8 finished scans: when, how they were started, by whom as an account ID, pages scanned and findings.
- When the review note on the admin page was closed.
The app never stores a full value it finds, a page's full text, or a user's display name or email address. A masked line keeps the other words around each value, and a masked title keeps its words, so either can still hold a name.
5
Where data goes
Nowhere. The app makes no network requests outside Atlassian and has no servers of its own. Data does not leave your Atlassian site's hosting region. Once a week the app sends Atlassian the list of account IDs it keeps, through Atlassian's personal data reporting, so Atlassian can say which of those accounts were closed; nothing else goes with them. Exports are generated in the administrator's browser and saved to their device; they hold masked values only, and what happens to them after that is under your control.
6
Legal basis and roles
You (the customer) are the data controller for the personal data on your site. TELCOMA Global is a data processor acting on your instructions, which consist of installing the app and running scans. Where the GDPR applies, the app's processing is performed under your instructions and on Atlassian's infrastructure.
7
Retention and deletion
A page's findings are replaced each time it is scanned, and a page with no findings has no record. Findings on pages that are deleted, trashed, archived or no longer visible to the app are removed at the end of the next full scan, or when an administrator clicks Rescan page; the page's marks are removed with them. The app keeps the summaries of the last 8 full scans; older ones are dropped automatically. The working list of spaces for a scan is deleted when that scan ends. Each space's key and name is overwritten by each full scan and kept until the app is uninstalled, including for spaces deleted in Confluence. When Atlassian reports that an account was closed, the app erases what it keeps about that person within hours: their account ID is removed as the last editor of a page, as the administrator who marked a finding and as who started a scan, and the stored key and name of their personal space are removed. The findings and marks themselves stay. If Confluence still names that account, a later scan can store its ID again, and the next weekly report removes it again. When the app is uninstalled, Forge deletes all app storage for your site. We cannot reach this data from outside the app, so we cannot delete it for you on request.
8
Security
The app runs on Atlassian Forge, which enforces the app's permissions at the platform level, hosts its storage, and isolates it from other apps. Every permission it holds is read-only, except the one that lets it send Atlassian the weekly list of account IDs it keeps; none can change a page, a space or a setting. Only Confluence administrators can open the app, and this is checked on every request. Before showing the details of a finding, the app checks that the administrator can open that page in Confluence. Values are masked before they are stored, and the hash key is kept as a Forge secret. Security issues may be reported to [email protected]; please do not post them publicly. See also our security policy for Atlassian apps.
10
Changes to this policy
We will update this policy when the app's data handling changes and note the effective date above.