Security Policy

Effective date: 2026-09-23 · Last updated: 2026-10-13

Scope. This policy describes the security posture of Arkidor for Confluence only — the Atlassian Forge app distributed through the Atlassian Marketplace. It does not cover the standalone Arkidor web application at arkidor.io, which is a separate product with its own data flow and documentation. The two products are legally and technically distinct.

1. Summary

Arkidor for Confluence is an ArchiMate® architecture modelling app delivered on the Atlassian Forge platform and distributed through the Atlassian Marketplace. It is a client-side Forge Custom UI app: its interface runs in a sandboxed iframe served by Atlassian and talks to Confluence exclusively through the Forge bridge, acting as the signed-in user.

Your ArchiMate model content is not transmitted to or stored on any Knaap-operated system — the app is designed so that model content stays within your Confluence tenant. Models are stored as page attachments inside your own Confluence Cloud site, and the app operates no separate backend, database, or server tier for your model content. The only data that egresses to a third-party service used by Knaap is scrubbed technical error telemetry sent to Sentry (see §6).

2. Shared responsibility & platform boundary

Arkidor for Confluence runs on Atlassian Forge. Platform-layer security — data-centre security, tenant isolation, encryption at rest and in transit, and platform breach handling — is provided and warranted by Atlassian under Atlassian's own agreements (see the Atlassian Trust Center and Atlassian's DPA). This policy describes Knaap's app-layer controls and the limited telemetry Knaap operates. Where this policy references at-rest encryption or tenant isolation, those are Atlassian platform properties, not independent Knaap guarantees.

3. Architecture & data flow

Arkidor for Confluence is a Forge Custom UI app. All Confluence API calls are made from the browser as the authenticated current user via the Forge bridge (requestConfluence). There is no app-identity / OAuth-consent data path and no server-side resolver or function tier handling your model content — every read and write is attributable to, and authorized as, the signed-in user.

• Client-side data path. The app cannot act "as the app" against your data; it acts only as the current user.
• Attachment-based storage. Each ArchiMate model is stored as page attachments on a dedicated Confluence page inside your tenant (editable source XML, metadata, and rendered view previews). These attachments are owned by you, governed by Confluence's permission model, and survive uninstalling the app.
• No cross-tenant infrastructure for models. The app does not extract, copy, cache, or store your model content on any Knaap-operated system.

4. Permissions & scopes (least privilege)

The app requests Forge scopes that are each exercised as the current user; Confluence enforces the user's own permissions on every call. The app requests no admin-of-instance / global scopes. The only elevated action — writing space-level display defaults — is gated by Confluence's native space Admin check, not by the app. A user who cannot view a page in Confluence cannot view its model through Arkidor; a user who cannot edit cannot save. Adding certain scopes on upgrade requires site admins to re-consent; these are not egress scopes.

The table lists every scope the app requests and why.

5. Authentication & authorization

• Acts as the current user. Every Confluence operation runs through the current user's authenticated Forge session. There is no service account, no stored API token, and no app-identity path for your data.
• Confluence permissions are the source of truth. Because calls execute as the user, Confluence natively enforces space/page/attachment permissions on every read and write.
• Admin actions gated by the platform. Writing space-level display defaults requires space Admin permission, enforced by Confluence.
• Change attribution. Because saves use the user's own session, Confluence's version history attributes each change to the correct person.
• Fail-closed / fail-soft behaviour. Permission or read failures degrade to safe defaults (view-only rendering) and do not escalate privilege.

6. Error monitoring & telemetry (Sentry)

To keep the app reliable, the interface reports runtime errors to Sentry (Functional Software, Inc.), configured for the EU region (ingest host *.ingest.de.sentry.io). This is the app's only declared external egress. It is declared to Atlassian under the analytics category with inScopeEUD: false: our attestation to Atlassian that the app is designed not to send in-scope End-User Data (ArchiMate model content, page titles), supported by the client-side scrubbing described below. Error telemetry is classified as out-of-scope End-User Data under Atlassian's Forge framework; it is nevertheless personal data under the GDPR and is handled as described in this section.

Model content is scrubbed on your device before sending. ArchiMate model content and page titles are designed to be removed on your device by client-side hooks from error and breadcrumb messages and from the report page URL and breadcrumb URLs before the report is sent; this client-side scrubbing is a best-effort control, not an absolute guarantee. Technical identifiers such as page, space or model IDs may appear in error and breadcrumb messages. Stack traces contain only the app's own code locations (function names and line numbers). Breadcrumb data other than the URL, request method, status code and logger name is discarded, and the browser's Referer header is removed. A limited set of diagnostic personal data is still transmitted to Sentry to make error reports useful, as set out below.

What is designed not to be sent: your ArchiMate model content, page titles, names or email addresses, session replays, release-health session tracking, behavioural analytics, cookies, or device fingerprints. Sentry is configured with sendDefaultPii: false, no performance tracing / session replay, and no release-health session tracking (error events only).

• Lawful basis: legitimate interest (GDPR Art. 6(1)(f)) — service reliability and security.
• Retention: error events are retained for 90 days, then deleted.
• International transfer. Telemetry is ingested and stored in the EU region. Because Sentry (Functional Software, Inc.) is a US-based processor, limited diagnostic data may be processed in the United States; any such transfer is safeguarded by the EU-U.S. Data Privacy Framework and, as a fallback, the European Commission's Standard Contractual Clauses (Module 2, controller-to-processor), together with the additional safeguards in Sentry's Data Processing Addendum (v5.1.0). This is not an absolute no-transfer guarantee.

Administrator egress opt-out ("Runs on Atlassian"). Arkidor for Confluence participates in Atlassian's Runs on Atlassian program and declares its Sentry error-monitoring egress under the analytics category. A Confluence site administrator can disable the app's analytics / error-monitoring egress to Sentry at any time using Atlassian's admin data-egress controls. When this egress is disabled, no diagnostic data is sent to Sentry. This is a platform-level control provided through Atlassian and is distinct from the scope-related re-consent on upgrade described in §4. Users may also object to this processing by contacting support@arkidor.io.

7. Data at rest, in transit, and isolation

• In transit. All communication with Confluence uses the Atlassian Cloud REST APIs over TLS (HTTPS). Telemetry to Sentry is transmitted over HTTPS. The app defines no plaintext transport.
• At rest. Model content is stored as attachments within your Confluence tenant and is encrypted at rest under Atlassian's platform controls (see the Atlassian Trust Center). The app maintains no separate data store.
• Tenant / data isolation. Because the app has no shared backend and stores nothing centrally, there is no vendor-side multi-tenant data store that could mix customers' data. Isolation is provided by the Atlassian Forge tenancy model and by the fact that all data access is scoped to the current user's tenant and permissions. An internal security review (SEC-105) tested for authorization bypass and cross-space isolation: identifiers used for reads and writes are platform-provided and path inputs are hardened against injection; findings are tracked to closure.

8. Secure development & assurance

• Content Security Policy. Forge enforces a strict platform CSP on Custom UI resources; the app is tested against an enforced, production-matching CSP.
• Internal security review (SEC-105). The space-configuration and template surfaces were reviewed by a security engineer, covering admin-write enforcement, absence of authorization bypass, user-scoped reads, cross-space isolation, and path-injection hardening.
• Supply-chain controls. CI enforces blocking dependency and licence checks and secret-history audits.
• Data-protection documentation. A privacy policy, terms, DPA, and dated sub-processor list are published for the app; a Legitimate Interest Assessment covers Sentry telemetry.
• Security self-assessment (CAIQ Lite v4.1.0 / CSA STAR Level 1). A completed CAIQ Lite v4.1.0 self-assessment (CSA STAR Level 1) documents the app's security posture against the Cloud Security Alliance Consensus Assessments Initiative Questionnaire; many infrastructure controls are inherited from the Atlassian Forge platform (SOC 2 / ISO 27001). This is a self-attestation, not independent assurance.

9. Hosting & sub-processors

The Confluence app itself runs on Atlassian's Forge platform, with no vendor-operated runtime for your model data.

The current, authoritative list — with data categories and transfer mechanisms — is maintained on our sub-processors page.

10. Data residency

• Your model content resides in your Confluence tenant and follows Atlassian's data-residency configuration for your site.
• Error telemetry is directed to Sentry's EU region, with the transfer safeguards described in §6.
• Marketing/help hosting and support/feedback run on AWS EU (eu-west-1, Ireland).

11. Regulatory posture (shared responsibility)

Arkidor for Confluence is an ICT service delivered on Atlassian Forge. Because the app operates no vendor-side store or processing tier for customer model content, the customer's operational-resilience and network-security obligations (e.g. under DORA or NIS2, where applicable to the customer) are met principally at the Atlassian platform layer. Knaap supports customer ICT-third-party requirements through least-privilege scopes, EU data residency for vendor-operated telemetry, a published sub-processor list with change notice, a GDPR Art. 28 DPA (including breach assistance and audit-information provisions), and a vulnerability-disclosure channel. This is a posture statement, not a certification or a representation of the customer's own regulatory compliance.

12. Incident response & vulnerability disclosure

• Contact: report suspected security issues to security@arkidor.io (or support@arkidor.io). Please report privately and allow reasonable time to remediate before public disclosure; do not access, modify, or exfiltrate data that is not yours while testing.
• Breach notification. As set out in the DPA §8, Knaap will notify affected customers of a personal-data breach affecting data processed under the DPA without undue delay and assist with GDPR Art. 33/34 obligations. Because in-tenant model content resides in the customer's Atlassian tenant, Atlassian's platform breach processes also apply and the customer is the controller for that content.

13. GDPR roles & related documents

GDPR controller/processor roles are defined in the Privacy Policy §5 and the DPA §1: the Customer is the controller and Knaap is the processor for in-tenant model/user data; Knaap is the controller for scrubbed Sentry telemetry. This security policy describes controls and does not duplicate or override those documents.

• Privacy Policy — transparency notice (data categories, lawful basis, rights, retention, transfers)
• Data Processing Agreement — GDPR Article 28 processor terms
• Sub-processors — current list with data categories and regions
• Terms of Use — licence and usage terms

14. Changes

We will update this policy as the product evolves and post the revised effective date above.

15. Contact

Knaap · Itäinentie 50 · 06100 Porvoo · Finland · support@arkidor.io