Security & data handling
Last updated: 1 November 2026
| Question | Answer |
|---|---|
| Hosting | Atlassian Forge only. Eligible for Runs on Atlassian (confirmed by forge deploy). |
| External network calls (egress) | None. The app manifest declares no external permissions. |
| Data stored by the app | Forge storage only: saved rules, trash first-seen dates (content ID + date), job progress, and run summaries for the last 30 runs (counts, content IDs, space IDs). No page content, titles or user names. |
| Data stored outside Atlassian | None. |
| Scopes | read:space:confluence, read:page:confluence, read:blogpost:confluence (inventory and
dry run); delete:content:confluence (delete old versions); delete:page:confluence, delete:blogpost:confluence
(purge from trash); read:confluence-user (administrator check); storage:app. |
| Who can use it | Confluence administrators only. The page lives in Confluence administration, and every request is checked on the server: the user's account (from Atlassian's request context) must have the Confluence "administer" permission. |
| Who the app acts as | The app (Forge app user), so daily rules can run without a browser. Only administrators can start jobs or save rules. |
| Safety rails | Dry run by default; typed DELETE confirmation; the current version is never deleted; the version list
is re-read before every delete; trash items restored meanwhile are skipped; one job at a time; daily trash rule needs at least 1 day. |
| Audit trail | The app's history lists the last 30 runs with a CSV report. Confluence's audit log records the deletions as well. |
| Personal data | None stored. Version author IDs are read from Confluence only in memory. |
| Data residency | Forge storage follows Atlassian's data residency for Forge apps on your site. |
| Analytics and tracking | None. |
| Sub-processors | None besides Atlassian, which hosts Confluence and Forge. |
| Vulnerability reports | Email prune@kenanislamoglu.com with the subject "Security". We acknowledge within 2 business days. |