This page describes how Auditable handles data, what it can and cannot reach, and how we handle vulnerabilities. It states only controls we actually operate; where something is not in place, it says so.
Auditable is an Atlassian Forge app. It runs entirely inside your own Atlassian cloud instance.
infrastructure for your content to reach, be stored on, or be breached from.
it makes is to Atlassian's own APIs. This is verifiable: egress in Forge must be declared in the manifest, and ours declares none.
Runs on Atlassian programme, which recognises apps that store data solely within Atlassian's cloud and perform no external egress.
Stored in Forge's storage inside your Atlassian tenant, encrypted at rest by Atlassian:
| Stored | Why |
|---|---|
| Confluence page IDs, titles and version numbers | To identify controlled documents |
| SHA-256 hash of approved page content | To detect edits made after approval |
| Atlassian account IDs of owners and approvers | To record who owns and who approved |
| Review dates, intervals and approval notes | To run review cycles |
We do not store names or email addresses. Only the opaque Atlassian account ID is recorded. Display names are resolved from Confluence at the moment you view a page or export a pack, and are never written to storage.
The app requests read-only Confluence scopes only. It cannot create, edit or delete your content — not because it chooses not to, but because it never requests permission to.
read:page:confluence · read:space:confluence · read:user:confluence · read:confluence-content.summary · storage:app
Compliance state is calculated across every controlled page so scheduled review checks keep working regardless of who is logged in. What you are *shown* is separate: the dashboard and the evidence export both filter the register down to pages you can already open in Confluence, asking Confluence as you rather than as the app. A page in a space you cannot read never appears in your document list and never reaches your evidence pack — not even its title.
If that permission check cannot be completed, the app shows nothing rather than guessing. Under-showing is a display problem; over-showing would be a disclosure.
Auditable never asks for, collects or stores passwords, Atlassian API tokens, personal access tokens or any third-party credentials. It holds no secrets.
Application logs are held by Atlassian within your environment; we operate no logging infrastructure of our own. We do not log credentials, tokens, passwords, or unnecessary personal information, and API response bodies are never written to logs, because they can contain page titles and account identifiers.
before release.
removed — including the permission filtering described above.
npm audit before each release;findings are fixed or recorded with a reason.
action by you.
Email security@rethought.to with SECURITY in the subject. Please do not open a public report. We aim to acknowledge within 2 business days, and we follow Atlassian's Marketplace security bug fix policy for remediation deadlines.
We will notify affected customers and Atlassian of any confirmed security incident or critical vulnerability affecting this app, following Atlassian's partner notification guidelines.
Stated plainly so nobody relies on a control we do not operate:
Our security position rests on architecture rather than on certification: the app holds no customer data outside your own Atlassian tenant, requests only read permissions, and sends nothing anywhere.