🛡️Atlassian Forge
🔒Read-Only Access
🏠No External Services
🇪🇺GDPR Compliant

Pulse — Security Policy

Pulse runs entirely within the Atlassian Forge platform. No external servers, no third-party APIs, no data leaving the Atlassian cloud. Your content stays where it belongs.

Last updated: April 2026

🏠

Zero External Services

Unlike many Marketplace apps, Pulse has no external backend, no cloud rendering service, and no third-party API calls. Everything runs within Atlassian's Forge sandbox.

👁️

Read-Only Access

Pulse only reads your Confluence content — it cannot modify, delete, or create any pages. The minimum possible permission footprint.

📊

No Raw Content Storage

Pulse never stores your page content. Only aggregated numerical scores are persisted. Your content is analyzed in-memory and immediately discarded.

🔐

Zero Personal Data

We do not collect, store, or process any personal user data. No analytics, no tracking, no advertising — ever.

Data Handling

How Pulse accesses, processes, and stores data

Data Flow

1

Content Analysis

Pulse reads your Confluence pages through official Atlassian APIs within the Forge sandbox. Content is analyzed in-memory using our proprietary scoring engine.

2

Score Aggregation

Only aggregated, numerical scores are stored in Forge SQL. No raw page content, no user data, no content copies.

3

Dashboard Display

Scores are displayed in the app's dashboard. All data remains within the Atlassian cloud environment at all times.

Data Storage Summary

Data TypeLocationRetentionEncrypted
Aggregated scan scoresForge SQL (Atlassian cloud)Until app is uninstalled✅ At rest & in transit
Content policy rulesForge SQL (Atlassian cloud)Until deleted by admin or app uninstalled✅ At rest & in transit
App configurationForge App StorageUntil app uninstalled✅ At rest & in transit
Raw page contentNot stored
Personal user dataNot collected

Subprocessors

Third-party services involved in data processing

ServiceProviderPurposeData LocationData Stored
Atlassian Forge Atlassian App runtime, SQL database, storage Per customer's Atlassian data residency Aggregated scores, app config

Pulse uses no other sub-processors. There are no external APIs, no cloud rendering services, and no third-party data processing of any kind.

App Permissions

Every permission explained

read:page:confluence
Read page content for quality analysis
read:space:confluence
List spaces for health reports
read:content-details:confluence
Access metadata (dates, versions) for analysis
storage:app
Store scan results and content policy config

Pulse requests only 4 scopes — all read-only (plus app storage). No write permissions, no search permissions, no attachment access.

Security Controls

Measures we implement to protect your data

🔑 Access Control

  • Read-only access: Pulse cannot modify any Confluence content
  • Confluence permissions: Respects native permission model
  • Minimal scopes: Only 4 API scopes — the minimum necessary

🔒 Data Protection

  • No external communication: Zero outbound network calls
  • Encryption at rest: Forge SQL encrypted by Atlassian
  • No raw content storage: Only numerical scores persisted

🏗️ Infrastructure

  • Forge sandbox: Isolated per-tenant execution
  • No external backend: Nothing to attack outside Forge
  • Managed by Atlassian: SOC 2 Type II certified infrastructure

📊 Development

  • Dependency scanning: Regular audits for known CVEs
  • Code review: Security-focused assessment
  • Minimal dependencies: Reduced attack surface

Incident Response

How we handle security incidents and vulnerabilities

Report a security issue: admin@bytera.tech — Subject: "Security Incident" or "Vulnerability Report"
Support Portal: Bytera Support

Response Process

PhaseActionTimeline
AcknowledgmentConfirm receipt and assign severity levelWithin 24 hours
TriageAssess scope, impact, and affected systemsWithin 48 hours
ContainmentIsolate affected components; disable features if necessaryImmediate upon confirmation
RemediationDevelop and deploy a fixBased on severity
NotificationNotify affected customers with details and remediation stepsWithin 72 hours of confirmation
Post-MortemDocument root cause, lessons learned, and preventive measuresWithin 2 weeks

Severity Classification

SeverityDescriptionTarget Resolution
CriticalActive exploitation, data breach, or complete service compromiseWithin 24 hours
HighVulnerability with significant impact potential but no active exploitationWithin 72 hours
MediumVulnerability with limited impact or requiring specific conditionsWithin 1 week
LowMinor issue with minimal security impactNext scheduled release

Our severity timelines align with the Atlassian Security Bug Fix Policy for Marketplace Partners.

Compliance

Regulatory and platform compliance

🇪🇺

GDPR

Bytera follows data minimization and purpose limitation principles. Since Pulse has no external sub-processors and stores no personal data, the compliance surface is minimal.

🏪

Atlassian Marketplace

Pulse adheres to all Atlassian Marketplace Partner requirements for security, privacy, and the Security Bug Fix Policy.

☁️

Forge Security

By building on Forge, Pulse inherits Atlassian's SOC 2 Type II certified infrastructure controls and benefits from their security-first platform architecture.

Frequently Asked Questions

Does Pulse store my Confluence content?

No. Pulse analyzes content in-memory and only stores aggregated numerical scores. Your raw page content is never copied, stored, or persisted anywhere.

Does any data leave the Atlassian cloud?

No. Pulse runs entirely within the Atlassian Forge platform. There are no external API calls, no external backends, and no data transmission outside of Atlassian's infrastructure.

Do you collect personal data?

No. We do not collect, store, or process any personal user data. We only access the Atlassian Account ID provided in the app context for permission checks.

Can Pulse modify my Confluence content?

No. Pulse has strictly read-only access. It cannot create, modify, or delete any pages, spaces, or content in your Confluence instance.

Are you GDPR compliant?

Yes. Since we don't store personal data and have no external sub-processors, the compliance surface is minimal. Users can request data access, correction, or deletion at any time.

What happens when I uninstall Pulse?

All app-related data (scan scores, content policies, configuration) is automatically removed by the Atlassian Forge platform. No residual data remains.

How do I report a security concern?

Please contact us immediately at admin@bytera.tech with the subject line "Security Concern". We respond within 24 hours.

Related Documents

Have a security question?

We're committed to transparency. If you have any questions about our security practices, data handling, or need additional information for your security review, please don't hesitate to contact us.