Security — Jigi Q&A for Confluence

Where your data lives

Jigi Q&A runs entirely inside Atlassian's Forge platform. It has no servers, no database and no external endpoints of its own.

Every question and answer the app creates is an ordinary Confluence page in your own site. There is no copy anywhere else. If you uninstall the app, the pages stay exactly where they are.

Permissions

The app calls the Confluence REST API as the signed-in user (asUser), never as the app itself. A person can only read or write what their existing Confluence permissions already allow, and a question inherits the restrictions of the space it was asked in.

The app does not request, store or transmit Atlassian API tokens, passwords or any other shared secret.

Network

No end-user content leaves Atlassian infrastructure. The app makes no outbound calls to third parties and collects no analytics on end users.

Logging — what we do record

When a Confluence API call fails, the app writes the error to the Forge platform log so the failure can be diagnosed. That line includes up to 500 characters of Confluence's own error response, which can contain a page title you wrote — for example when two questions share a title.

Those logs stay inside Atlassian and are never exported. We are narrowing this to the status code alone in a coming release.

Compliance

• No compliance certifications at this time.
• CAIQ Lite questionnaire: not completed.
• Not a GDPR data controller or processor for this app — no end-user data reaches us.
• Data residency follows Confluence, because the data never leaves it.

Reporting a security issue

Email contact@capsule26.com. We aim to acknowledge within two business days. Please include the steps to reproduce; do not include customer data in the report.