Security & Compliance
Page Pulse shows a freshness status on every Confluence page, scans your spaces daily, and gives admins a ranked report plus a one-click review workflow to keep documentation trustworthy.
Last updated: 16 June 2026
Page Pulse is an Atlassian Forge app for Confluence Cloud. It runs entirely on Atlassian's infrastructure, stores all data within Atlassian, and makes no external network calls. This page summarises its security posture, the permissions it requests, and how to reach us about security.
Hosting & architecture
- Built on Atlassian Forge; all code runs on Atlassian-hosted infrastructure (FaaS), inheriting the platform's tenant isolation and security controls.
- No external backend or remote services. The app declares no external network permissions and egresses no data outside Atlassian.
- All app data is stored in Atlassian Forge storage and Confluence content properties — never in any system outside Atlassian.
Permissions & justification
Page Pulse follows the principle of least privilege — it requests only the Confluence permissions required for its functionality. Each is justified below.
| Permission | Why Page Pulse needs it |
|---|---|
| Read and write to app storage service | Store the app's own data — per-space settings, daily scan results, and review state — in Atlassian Forge storage. |
| View space details | Enumerate the site's spaces during the daily freshness scan. |
| Read a summary of space information | Determine whether the current user is a space administrator, to gate the admin report, settings, and actions. |
| View page content | List pages and read page metadata (title, last-updated date, owner) and the app's own freshness property. The app reads metadata only — it does not store page body text. |
| Create and update pages | Write the freshness status to a small content property on each page (the cached value the byline displays). The app does not create or alter page body content. |
| View labels associated with content or space | Support the "excluded labels" setting and the report's label filter. |
| View user information / user details | Look up a page's owner (display name) and detect when an owner may no longer be active, for attribution in the report. |
| Create and update comments on content | Post a comment that @mentions a page's owner when a review is requested, delivering an in-product notification. |
Data handling
- Processes only Confluence page metadata (titles, dates, labels) and page-owner account IDs and display names. Page body content is never read or stored.
- All data remains within Atlassian; nothing is shared with any third party.
- No Atlassian credentials, API tokens, or passwords are collected.
- Application logs contain only operational data (space keys, identifiers, counts) — no credentials, tokens, or secrets.
Full detail is in our Privacy & Data Handling statement.
Application security practices
- Authorization on every request (zero-trust aligned): all user-initiated actions verify the caller's Confluence permissions server-side (space-admin status, and page ownership for "mark as reviewed") before any operation. Client-supplied values are never trusted.
- Least privilege: only the scopes listed above are requested, each mapped to a specific function.
- Secure development: the codebase is scanned with static analysis (SAST — ESLint with security rules) and dependency/open-source analysis (SCA — npm audit). Runtime dependencies are limited to Atlassian's official Forge SDK and React, kept current as Atlassian releases updates.
- Input handling: user inputs are validated and constrained (fixed-option settings, sanitised label lists, encoded parameters).
- No shared secrets: the app never requires users to provide Personal Access Tokens, passwords, or other shared secrets.
Vulnerability management & reporting
- We perform static and dependency vulnerability scans and review the results as part of our release process.
- We are committed to notifying affected customers and Atlassian promptly in the event of a security incident or critical vulnerability, in line with the Atlassian Marketplace security policies.
- Security issues can be reported to us at the contact below; we aim to acknowledge and respond promptly.
Compliance posture
Compliance certifications: None claimed for this version. Page Pulse relies on the security and compliance controls of the Atlassian Forge platform on which it runs.
Data protection: BuzzClan is committed to complying with applicable data protection regulations (including the GDPR and CCPA where relevant). Because Page Pulse stores all data within Atlassian and performs no external processing, its data-handling footprint is minimal. Data-processing terms and specific compliance documentation are available on request.
Personal Access Tokens / passwords: Not required and not collected.
Security contact
To report a security concern or request security/compliance documentation for Page Pulse, contact BuzzClan at info@buzzclan.com.
