Security
Where ReadSeal runs, what it keeps, and what it never does.
It runs on Atlassian, and nowhere else
ReadSeal is a Forge app. Its code runs on Atlassian's infrastructure and it declares no external host, which is what Atlassian's "Runs on Atlassian" programme attests at each deployment. It sends no email, no message to Slack or Teams, and no analytics. No data leaves your Atlassian site.
Everything it stores goes to Forge hosted storage, which follows your site's data residency.
What it stores
| Data | Why |
|---|---|
| Campaign: its name, the message and attestation text a manager wrote, space, dates, time zone, options, the account id of its creator | The request itself |
| Request and confirmation: account id, page, version confirmed, date, own due date, a "no access" flag, a fingerprint of the attestation text | The evidence |
| The counter under a page title: the figures and the campaign name, as a page property | What readers see |
| Register: page ids, campaign names and states | Finding the evidence again |
No name and no email address is stored. Names are read from Confluence at the moment a campaign page is written, kept in memory for ten minutes at most to spare the API budget, and never written to storage.
Logs hold counts, HTTP statuses and error codes. No account id, no page title, no email address.
Which permissions it asks for
Every Confluence permission ReadSeal requests is used by a call it actually makes: reading pages and their versions, writing its own campaign pages and the counters, reading the members of the groups you assign, posting the reminder comments, uploading the CSV, and checking whether each recipient can open each page. It does not ask for the broad content-write permission that deleting or trashing pages would require.
Pages are listed through your own Confluence session when you build a campaign, so a manager can only ever target pages they are allowed to see.
Who can do what
- Confluence administrators, and the groups they designate, manage campaigns. Nothing is open by default.
- An administrator can narrow what each manager sees to their own campaigns, or to those of their team.
- Every check runs again on the server: hiding a screen is not a permission.
- A confirmation is refused for an anonymous visitor, for a page whose version the app cannot read, and when the page changed while it was being read.
Keeping and erasing
- An administrator chooses how long closed campaigns are kept in the app: always, or 1, 3, 5 or 10 years. Their pages in Confluence are never touched by that.
- Every account ReadSeal holds data about is declared weekly to Atlassian's personal data reporting API. An account reported closed is erased from the app, everywhere it was named.
- Campaigns cannot be deleted from the app: closing one freezes its record.
Reporting a vulnerability
Write to contact@owlworks.dev with enough detail to reproduce the issue. We answer within two business days, keep you posted until it is fixed, and credit you if you want to be. Please do not test against other people's Confluence sites.