Security Statement & Self-Assessment: Universal Mermaid Renderer for Jira and Confluence
Universal Mermaid Renderer is built exclusively on Atlassian Forge, a secure, cloud-native platform that provides strong isolation, encrypted storage, and protected execution environments. We take the security of your data seriously and have designed our app to operate with the minimum required access and strong safeguards.
The app respects Jira and Confluence’s permission models and does not expose any data beyond what the logged-in user is authorized to view. The app stores only minimal metadata (rendered diagram hashes and SVG output) required for caching performance and does not perform automated content modification or background changes to issue or page data.
Part 1: General Security Overview
1. General Information
Item | Details |
|---|---|
App Name | Universal Mermaid Renderer for Jira and Confluence |
App Type | Jira & Confluence Cloud App (Atlassian Forge) |
Hosting Model | Atlassian Forge (Atlassian-hosted) |
Deployment | Jira Cloud & Confluence Cloud |
Target Users | All Jira and Confluence Users |
Data Sensitivity | Low (diagram code and rendered SVGs only) |
2. Authentication & Authorization
Area | Implementation |
|---|---|
User Authentication | Handled by Atlassian (Atlassian Cloud login) |
Authorization Model | User-as-user (All actions performed in the context of the active user) |
Permission Enforcement | Fully enforced by Jira & Confluence APIs |
Elevated Privileges | Not used |
App Roles | No custom roles; follows standard user permissions |
3. Permission Scopes Requested
Scope | Purpose | Risk Level |
|---|---|---|
| Read issue descriptions and comments to find Mermaid code blocks | Low |
| Read macro body content to render diagrams | Low |
| Cache rendered SVGs to improve loading speed (30-day TTL) | Low |
4. APIs Used
API Category | Usage | Permission Context |
|---|---|---|
Jira Issue API | Load issue description/comments for diagram extraction | User |
Confluence Macro API | Load macro body for rendering | User |
Forge Storage API | Store and retrieve cached SVG renders | App (Isolated per tenant) |
5. Data Stored by the App
Data Type | Stored? | Details |
|---|---|---|
Original Content | No | The app parses content in real-time; only the diagram code is processed. |
Diagram Code | No | Only the content hash is stored; original code is not persisted. |
Rendered SVGs | Yes | Processed SVGs cached in Forge Storage for performance. |
Metadata | Yes | Content hashes and creation timestamps for cache management. |
PII | No | No user names, emails, or personal identifiers are stored. |
6. Data Retention & Deletion
Aspect | Behavior |
|---|---|
Default Retention | Cache items expire automatically after 30 days. |
Data Deletion on Uninstall | Automatic via Forge (app storage is permanently cleared). |
Manual Deletion | N/A (Transient cache only). |
Backups | Managed by Atlassian (Forge platform). |
7. Permission Handling Scenarios
Scenario | App Behavior |
|---|---|
Issue/Page Restriction | Renderer fails to load (App respects Atlassian view permissions). |
Restricted Comments | The app only scans comments the current user can see. |
Anonymous Access | App functionality is restricted to authenticated users. |
8. UI & Privacy Controls
Area | Design Choice |
|---|---|
Data Display | Only renders diagrams based on existing visible text. |
External Analytics | None (No 3rd party tracking, no Google Analytics). |
External CDNs | None (All resources served from Forge). |
9. Data Security
Control | Implementation |
|---|---|
Data at rest | Encrypted by Atlassian (AES-256). |
Data in transit | TLS 1.2+ (Atlassian managed). |
External storage | Not used (100% data residency within Atlassian). |
Secrets management | Atlassian managed (Forge environment variables). |
Tenant isolation | Enforced by Forge (Data for one site is never accessible to another). |
10. Operational Security
Area | Approach |
|---|---|
Logging | Forge platform logs only; no sensitive data logged. |
Monitoring | Atlassian standard monitoring. |
Rate limiting | Jira/Confluence API rate-limit aware (with exponential backoff). |
Execution | Isolated Node.js runtime provided by Atlassian. |
11. Compliance Considerations
Standard | Status |
|---|---|
GDPR | Compliant (No PII stored). |
Atlassian Marketplace | Compliant with all Forge security requirements. |
SOC2 / ISO 27001 | Inherited via Atlassian Forge infrastructure. |
12. Explicit Non-Goals
We do not transmit diagram code or data to external rendering services.
We do not modify Jira issues or Confluence pages (Read-only for content).
We do not track user behavior or interaction within the app.
Part 2: Security Self-Assessment (Marketplace Questionnaire Support)
1. Data Residency & Storage
Where is data stored? All app data is stored exclusively within Atlassian's Forge Storage. No external databases, servers, or cloud providers (AWS, GCP, Azure) are used.
What data is persisted? The app persists:
SVG Renders: Rendered diagram outputs are cached to avoid re-calculating the same diagram multiple times.
Hashes: SHA-256 hashes of diagram code are used as cache keys.
Timestamps: Creation dates for cache lifecycle management (30-day TTL).
Is PII stored? No. The app does not store user names, email addresses, or account IDs. It only stores diagram-related metadata.
2. Network Security
Does the app communicate with external servers? No. The app does not make any outbound network requests (
fetchorrequest) to external domains. All rendering and data processing happen within the Forge sandbox.
Is data encrypted in transit? Yes. All communication between the user's browser, the Forge platform, and Jira/Confluence APIs is encrypted using TLS 1.2 or higher, managed by Atlassian.
3. Access Control
How does the app access Jira/Confluence data? The app uses the @forge/api with asApp() or asUser() contexts. It only accesses data required for its function (descriptions and comments) and only if the current user has permission to view that data.
What permissions does the app require?
read:jira-work: To scan for Mermaid blocks in issues.read:confluence-content.summary: To read macro bodies in Confluence.storage:app: To manage its performance cache.
4. Input Validation & Security
How does the app handle malicious scripts in Mermaid code? The app treats Mermaid code as raw text. The rendering process produces an SVG. Since the app runs in the Forge sandbox and uses Atlassian's UI Kit / Custom UI components, "unsafe-inline" styles and scripts are restricted by the platform's Content Security Policy (CSP).
Is the app vulnerable to XSS? The app relies on the security of the Forge platform's rendering engine and the Mermaid.js library (run client-side in an isolated iframe). It does not directly inject raw HTML into the Jira/Confluence UI.
5. Maintenance & Disposal
What happens when the app is uninstalled? The Atlassian Forge platform automatically deletes all data associated with the app's storage:app for that specific tenant. No data remains on our side because we do not host any servers.
How are security patches handled? As a Forge app, we update the app by deploying new versions to the Marketplace. Patching the underlying OS, Node.js runtime, or infrastructure is handled entirely by Atlassian.
⚠️ @Meghna Patankar FreshPage Notice: This page is currently aging (115 days since last verification). Please review the content and mark as fresh if it is still valid.