Definitive DiagramsThis policy describes how the Definitive Diagrams app for Confluence Cloud and Jira Cloud ("the app") protects your data, and how to report a security problem. The app is provided by e360 ("we", "us"). How the app handles data is also covered in the privacy policy.
Summary
- The app runs entirely on Atlassian's Forge platform and in the reader's browser, and is eligible for Atlassian's Runs on Atlassian program.
- It makes no network requests outside Atlassian. We run no servers of our own, nothing is stored on servers, and we cannot access your content. Diagrams are never sent to Microsoft.
- It only reads files, and it reads them as the person viewing them, so your Confluence and Jira permissions apply.
Hosting and infrastructure
The app is hosted by Atlassian on its Forge platform; see the Atlassian Trust Center for Atlassian's controls and certifications. Diagrams are drawn inside Atlassian's sandboxed app frame, under a content security policy that blocks outside scripts and connections. The only relaxation the app asks for is inline styles, which diagram labels use. The app declares no external domains, remote back ends or web triggers, so there is no route for data to leave Atlassian.
Data the app handles
- Diagram files attached to the page, blog post or work item where the app is used, read with the viewing person's own permissions and drawn in their browser.
- Macro settings (the chosen file, or the Mermaid or PlantUML code you typed, and the height), stored by Confluence in the page like any macro's settings.
- A cache in the reader's browser of diagram pages already viewed, capped at 200 MB and cleared of files unused for 30 days. Before using it, the app checks with Atlassian that the reader can still see the file and that it hasn't changed.
The app stores no names, email addresses or Atlassian account IDs, and keeps no data in app storage.
Access control
- Read-only, least privilege. The app asks only to read attachments in Confluence and to read work items (for their attachments) in Jira. It has no permission to create, change or delete anything.
- Your permissions apply. Every file is read as the person viewing it, so people only see diagrams from files they're allowed to open.
- Untrusted files are handled safely. Diagram files are parsed in the browser, and text drawn from them is sanitised before it's shown (Mermaid, for example, runs in its strict security mode). Macros inside .vsdm files are never run.
Authentication
Atlassian handles sign-in. The app has no accounts or passwords of its own, and never asks for API tokens or personal access tokens.
Logging
In production the app writes nothing to its logs, so no diagram content or personal data ever reaches them.
Secure development
- Every release is checked by automated tests across the supported formats, including the viewer running under a Forge-like content security policy.
- Each production build is checked for Runs on Atlassian eligibility.
- Third-party components are kept up to date and checked for known vulnerabilities, and the build fails if a bundled component's license isn't recorded.
- We follow Atlassian's security requirements for cloud apps.
Reporting a vulnerability
If you find a security problem in the app, email support@definitivediagrams.com with "Security" in the subject. Please include the steps to reproduce it and don't share the details publicly until it's fixed. We acknowledge reports within one business day, keep you updated, and fix confirmed issues within the timeframes Atlassian sets for Marketplace apps.
Security incidents
If a security incident affects your data, we will notify you and Atlassian without undue delay, explain what happened and what we are doing about it, and follow up when it's resolved.
Retention and deletion
The browser cache empties itself as described above, and anyone can clear it by clearing their browser's site data. Macro settings stay in your pages until you remove the macro. When the app is uninstalled, your files stay attached to their pages and work items.
Contact
Security contact: support@definitivediagrams.com