Security Policy

Introduction

This page describes how Quick Questions & Answers (Q&A) for Confluence protects your data: where it runs, what it can access, what it keeps, and how security problems are handled. The privacy policy describes in more detail what the app does with your data.

Where the app runs

The app is built on Forge, Atlassian's platform for cloud apps. Its screen is hosted by Atlassian and runs in your browser, inside Confluence. The rest runs as functions on Atlassian's Forge platform: one function answers the screen, two background workers handle imports and the recount of votes, and two scheduled tasks run on their own, one every 5 minutes to catch up on vote totals and one every hour for personal data (described below).

Webelisys runs no server for the app. The app declares no external domain, no remote back end and no web trigger, so it has no way to send data outside Atlassian, and nothing outside Atlassian can call it.

What the app reads and writes in Confluence

Each question is a Confluence page, and each answer is a child page of its question. In the space of the question, the app writes:

• the pages of questions and answers, and the labels you give a question;
• two labels of its own: qa-question on each question and qa-acceptee on the accepted answer;
• three page properties: qa_votes (the vote total), qa_acceptee (which answer is accepted) and, on imported pages, a page property that records the import source and its identifier, with dates, no name and no account;
• a "View this question in Q&A" link at the top of new questions asked in team spaces;
• the comments copied during an import, and the comment that tells the author of a question about a new answer.

The app reads the pages, labels, properties and comments of the space, and the display names of authors. During an import from another Q&A app installed on your site, it reads that app's questions, answers, vote totals, labels, comments and the names of attachments.

What the app keeps in its storage, and for how long

Besides your Confluence pages, the app keeps a few records in the storage that Atlassian provides to Forge apps:

• one record per vote and per person, whose key includes the person's account identifier;
• a counter of the votes of closed accounts, with no identity;
• the state and lock of an import, and the imported file while the import runs (it is deleted at the end, or at the next import);
• the list of answers of each question;
• the settings of each space;
• a list of pages to repair, when a label could not be added (it can name the author);
• the state of the personal data report.

No page content is copied into this storage, except the imported file while the import runs.

Questions, answers, labels and page properties stay in your Confluence site for as long as you keep them, including after the app is uninstalled. Vote records are not deleted while the app is installed, unless the account is closed. Atlassian deletes the app storage 28 days after the app is uninstalled, as described in the Forge storage documentation.

Encryption

All traffic between your browser, Confluence and the app's functions goes through Atlassian. Under Forge's shared responsibility model, Atlassian encrypts it with TLS and HSTS, and encrypts at rest the data kept in Forge app storage. Your pages stay in Confluence and are protected by Atlassian like the rest of your Confluence data. The app stores nothing outside Atlassian. See the Atlassian Trust Center.

Access and permissions

The app requests 15 permissions. What each one is used for:

• storage:app: keeps the records listed above in Forge app storage.
• read:space:confluence: finds the space, checks that it is not archived, and checks whether you may create pages in it.
• read:page:confluence: reads question and answer pages, their children and titles, to build the list, to export, and to recognise pages that were already imported.
• write:page:confluence: creates the page of a question, the child page of an answer, and adds the link line to a new question.
• read:content.property:confluence: reads the page properties the app writes and, during an import, the vote total and accepted answer kept by the other Q&A app.
• write:content.property:confluence: writes the properties qa_votes and qa_acceptee, and the page property that records the import source.
• write:label:confluence: adds the labels of a question and the app's own labels.
• write:confluence-content: adds and removes the labels qa-question and qa-acceptee through a Confluence endpoint that needs this permission.
• read:comment:confluence: reads comments during an import, and imported comments during an export.
• write:comment:confluence: recreates imported comments, and adds the comment that tells the author of a question about a new answer.
• read:custom-content:confluence: reads the questions and answers that another Q&A app stores as custom content, to import them.
• read:attachment:confluence: lists the attachments of imported questions, so the report can say they were not imported.
• read:confluence-user: reads display names, and identifies the app's own account so it can recognise its pages when an import resumes.
• search:confluence: lists the questions of a space by label, looks for similar questions while you type, and finds the questions to export.
• report:personal-data: reports the account identifiers the app stores to Atlassian's personal data API, so that closed accounts can be erased.

Asking a question, answering, loading the list, looking for similar questions, exporting, and reading the other Q&A app during an import are done in your name, with your own Confluence permissions. A page you are not allowed to see is not shown to you and is not exported.

A few writes are made in the app's name, after the app has checked your own rights: the vote properties, the qa-acceptee label, and the pages created by an import. The background tasks also act in the app's name.

Who can do what:

• Asking and answering need the right to create pages in the space. A space administrator can limit them further, to some groups or to administrators.
• Reading, voting and exporting are open to every signed-in person who can see the question. Nobody can vote on a closed question.
• Accepting an answer is for the author of the question or a space administrator. On an imported question, only space administrators can accept.
• Importing needs the right to create pages and to ask questions in the space.
• Settings are for space administrators.

Personal data

The app stores Atlassian account identifiers: in the vote records, in the list of pages to repair, and in the state of an import. Page properties never hold a name or an account identifier.

As Atlassian requires, the app reports these account identifiers to Atlassian's personal data API. A scheduled task runs every hour, and each account is reported at most once every 6 days. When Atlassian says an account is closed, the app erases that person's vote records and moves their votes to the anonymous counter, so vote totals do not drop. It also removes the account from the list of pages to repair and from the state of imports.

The names of the authors of imported questions are written in the text of the imported pages. An export file can contain the display names of authors. Once downloaded, that file is the responsibility of the person who exported it.

Logs and tracking

The app's functions write short technical logs, kept by Atlassian's Forge platform: the kind of event, status codes, and short error messages. They are written to leave out account identifiers.

The app sets no cookies, uses no analytics and contains no tracking. Webelisys receives no information about your questions, your answers or how often you use the app.

How the app handles what it reads

Questions and answers are written and shown as plain text. When content is imported, the app removes scripts, iframes, attributes that run code, javascript: links and every Confluence macro outside a short list of safe ones. An @name is never turned into a real Confluence mention, so an import sends no mention emails. In CSV exports, a value that starts with =, +, - or @ gets an apostrophe in front, so that a spreadsheet does not run it as a formula.

Imports have fixed limits: a file of 20 MB at most, and about 200 KB for one question with its answers. A bigger question is skipped and reported.

The app holds no password, API token or other secret, and never asks for your Atlassian password or API token.

Limits you should know

There is no anonymity. Authors and votes are visible to anyone who can read the page, including through the Confluence API. Comments written directly on a Confluence page are not shown in the app and are not exported.

Vulnerability management

Before each release, we run the app's automated tests and an audit of its dependencies against known vulnerabilities. The exact versions of its dependencies are fixed in its lock file, and we update them when a security fix is published.

We fix confirmed vulnerabilities within the deadlines of Atlassian's Security Bug Fix Policy for cloud apps, counted from the report or triage:

• Critical: within 10 days.
• High: within 4 weeks.
• Medium: within 12 weeks.
• Low: within 25 weeks.

Security problems in the Forge platform itself are fixed by Atlassian.

Security incidents

If we learn of a security incident that affects the app, we report it to Atlassian, as the Marketplace rules require, and we inform the affected customers.

Reporting a vulnerability

To report a security problem, write to contact@webelisys.fr with "Security" in the subject. Please describe the problem and how to reproduce it, and do not include personal data or the content of your pages. We acknowledge every report within 2 working days.

Certifications

Webelisys holds no security certification for this app: no SOC 2, no ISO 27001, and no completed CAIQ Lite questionnaire. For Atlassian's own certifications, see the Atlassian Trust Center.