Security

Summary

Where the app runs

Compliance in a Box is built on Atlassian Forge and carries the "Runs on Atlassian" designation. All of its code runs on Atlassian's infrastructure, and all of its records are kept in Forge hosted storage that belongs to your Atlassian site's installation of the app.

The app declares no external domains, has no remote back end and no web triggers, and uses no subprocessors other than Atlassian. Its user interface is built only from Atlassian's Forge UI Kit components, so the app renders no custom HTML in your browser.

Auralite Solutions does not receive, view or export your data. There is no Auralite server for the app to send it to. What we do receive from the Atlassian Marketplace is licensing information: your site address, license tier and license contacts.

What the app stores

The app stores only the records it needs to run your compliance program:

• People, as Atlassian account IDs only: policy and activity owners, approvers, submitters, people asked to acknowledge a policy, reminder recipients, and the person behind each recorded action. Names and email addresses are not stored; names are looked up live from Atlassian when a page is shown. The one exception is the security contact in your company profile, where an admin may enter an organizational mailbox address instead of choosing a person.
• Workflow records: policy versions (page ID, version number, content hash, change summary), approvals and rejections with the approver's comment, acknowledgements, recurring-activity periods and submissions with their notes, skip reasons, and a reminder log.
• An append-only audit log of those actions.
• Settings: the Confluence group IDs you chose for employees, admins and optional auditors, your company name, fiscal year and security contact.
• Imported text, briefly: during a policy import, the source page's text is held until it has been written to the target page, then cleared.

Your policies, evidence pages and generated reports are ordinary Confluence pages in your compliance space. Confluence stores them, not the app. The privacy policy has the full list of what the app stores.

Storage and encryption

App records live in Forge hosted storage inside your own installation: Forge SQL for the records above, and the Forge key-value store for small, disposable job state such as locks and run summaries. Forge keeps each installation's storage separate, and the app keeps no cached data between requests, so nothing is shared between customers.

Data residency is supported: app data follows the data residency location of your Confluence site.

Encryption at rest and in transit is provided by Atlassian's Forge platform. The app holds no secrets of its own: no encryption keys, API keys or external credentials.

Permissions the app requests

The app asks Confluence for the following permissions (Forge scopes). Each one is tied to the specific API calls that need it.

This set was settled before the first public release and is locked by an automated test, so it cannot change by accident. Adding a permission would make a major version of the app that every site admin must approve before it installs. The app deliberately does not request permission to write comments, manage users or groups, or reach any external service.

Access control

The app checks who you are and what you may do on every request. Your identity comes from Atlassian's Forge runtime, never from anything sent by the browser, and your role (Compliance Admin, employee, owner, approver, or someone with a pending acknowledgement) is resolved fresh each time. Confluence site admins are always Compliance Admins. The interface hides actions you may not take, and the server refuses them even when called directly.

The app also locks down the pages it manages in Confluence:

• Policy, activity and evidence pages can be edited only by their owner, your Compliance Admins and the app.
• Generated Evidence & Reports pages can be viewed only by Compliance Admins, the optional Auditors group and the app.
• Each person's reminder task page can be viewed only by that person, Compliance Admins and the app.

A daily job re-applies these restrictions, so drift is repaired. The app records every restriction it grants and only ever revokes its own, so restrictions your admins add by hand are left alone. On Confluence Free, page restrictions are not available; the app warns admins about this in Settings.

Evidence integrity

When someone submits a policy or evidence page for approval, the app records the page's version number and a SHA-256 hash of its content. Approvals and acknowledgements are bound to that exact version. If the page changes before an approval completes, the submission is invalidated and must be made again, so an approval can never apply to content the approver did not see. The version number is the binding rule; the hash is corroborating evidence.

The app never edits a policy or evidence page after creating it. The only exception is a policy import, which an admin runs deliberately and which is refused while a version is pending approval.

Every state change (submit, approve, reject, acknowledge, skip, settings change, provisioning) is written to an append-only audit log that is never pruned. The only change ever made to an existing audit entry is the erasure of a closed account, described below. Approving your own submission is allowed but recorded as such, and the Dashboard reports approvals made without an independent approver.

Personal data and retention

At least once every seven days the app reports the account IDs it stores to Atlassian's personal data reporting service, as Atlassian requires. When Atlassian reports an account as closed, the app erases it: any open acknowledgement requirements are waived, and the account ID is replaced in the app's records, including the audit log, by a random placeholder, so records stay consistent but the person can no longer be identified. The app shows "Former user" in its place. If the person was your security contact, the contact is cleared. Their private task page is emptied and moved to the space trash.

Deactivated accounts are detected daily. Their open acknowledgements stop being required (and come back if the account is reactivated), and admins are prompted to reassign anything the person owned or approved.

App data is kept while the app is installed; the audit log is never pruned, because it is compliance evidence. When you uninstall, Atlassian soft-deletes the app's hosted storage and deletes it after its retention period. It can be reconnected to a reinstall only on a support request made within 21 days. Your Confluence pages, including the generated Evidence & Reports pages, stay in your space. The user guide has the admin's view of this.

Logging

The app's logs carry identifiers, counts and Confluence error codes only, never page content, names or email addresses. An automated test fails the build if a log statement references a page body, display name or email. The logs are Atlassian Forge developer logs, which we use only to troubleshoot.

How we build and release

Every change to the app runs through continuous integration before it can be merged:

• Linting and the full automated test suite, which includes security tests that assert that every server-side function checks the caller's role, every entry point checks the license, all database queries are parameterized, no secrets or tokens are committed, the permission set above is unchanged, and database migrations are locked and upgrade cleanly from every earlier release.
• A dependency audit that fails the build on any known high or critical vulnerability in the app's runtime dependencies.

The app runs on Node.js 24 on Forge and keeps its dependencies small: Atlassian's Forge SDKs, React for UI Kit, and one library for generating identifiers.

Releases are tagged versions deployed to Forge's production environment. Minor updates reach your site automatically; an update that adds a permission is a major version that waits for your site admin's approval. Since the first public release, database migrations are additive only, so an update never drops or rewrites existing records. Security fixes ship as hotfixes within the permissions already approved.

Reporting a vulnerability

If you think you have found a security vulnerability in Compliance in a Box, email support@auralitesolutions.com with "Security:" at the start of the subject. Please include:

• your Confluence site URL,
• the app version (shown under Manage apps in Confluence administration),
• steps to reproduce, and
• the impact you expect.

Security reports are handled before other support requests. Please give us a reasonable chance to fix the issue before disclosing it publicly.

Fix timelines

We follow Atlassian's Security Bug Fix Policy for Marketplace apps. Confirmed vulnerabilities are fixed within these timelines, counted from the report:

Security incidents

If we become aware of a security incident affecting customer data, we report it to Atlassian under the Marketplace program's incident process and notify affected customers through their license contacts.

This website

This website is a set of static pages served over HTTPS from GitHub Pages. It has no sign-in, no forms and no advertising. Google Analytics is loaded only after you accept the cookie banner; until then nothing is sent to Google. The privacy policy has the details.

Changes to this page

We update this page when the app's practices change and record the date at the top. The privacy policy and terms of use set out our legal commitments; this page describes how the app works.

Contact

Auralite Solutions
Email: support@auralitesolutions.com