Security

How the app is built, and the rules it follows about your content.

Runs on Atlassian

Space Factory is built to Atlassian’s Runs on Atlassian standard, and the Forge CLI confirms every version as eligible. All of it — the code and the storage — runs on Atlassian’s Forge platform. There are no servers of ours, no third-party services, no analytics, no AI calls and no outbound network access of any kind. Nothing about your Confluence ever leaves Atlassian’s cloud.

Nobody gets content they aren’t allowed to see

Before any copy, Space Factory lists the source twice: once as the person asking, and once as the app. Pages you can see but the app can’t are reported — the first 25 by name — and left out. If the app can see a page you can’t, the whole creation stops — Confluence copies a page tree all at once, and we would rather refuse than hand somebody a page they aren’t allowed to read.

Permissions are checked on the server

Who is asking comes from Confluence itself, never from the browser, and every action is checked again at the moment it runs: who may make templates, who may use each one, who may approve, who may copy a space, and who may change settings.

Nothing the app didn’t create is touched

The app keeps a record of everything it makes. A space, page, blog post, comment, restriction or watch is written down before it is made and again once it exists, so a creation cut off halfway can be finished or undone. A label is written down once it is added. Role assignments and space labels aren’t recorded on their own: they belong to the space the app made, and archiving or deleting that space takes them with it. Undo only ever acts on that record. The app never edits or deletes a space or a page it didn’t create.

Deliberate about destruction

Undo archives by default. A permanent delete needs all five of: a Confluence admin turning the setting on, the app having been able to look inside the space, nobody else having worked in it, somebody typing the space key, and the app checking all of that again on the server at the moment it acts. If it could not look — an archived space, a space too large to read every comment — it says so and archives instead.

Content can’t be injected

Values people type into blanks are escaped for exactly where they land in a Confluence page, so a value can’t smuggle in a macro or a script. There is a test for it that tries.

Logs

The app logs ids, counts and outcomes. Never names, email addresses, page titles or the values people type. Errors from Confluence are recorded as a status and a path, never a response body.

Separation

Each installation has its own storage, provisioned by Forge. There is no shared store between customers and no code path that takes a site identifier as input.

Reporting something

Email hello@goldstandardweb.com with “Security” in the subject. Security reports are always treated as critical: we reply within 24 hours, any day. Other support is answered within 24 hours when it’s critical and within 5 business days otherwise (see Support). Please don’t include anyone’s personal data in the report.