Security

Last updated: 3 September 2026

This page describes how Policy Acknowledgement Tracker (the "App"), published by Rethought, is built and secured. It is separate from our Privacy Policy, which explains what data the App stores.

Runs entirely on Atlassian

• The App is built entirely on Atlassian Forge and runs exclusively on Atlassian-operated infrastructure. It is eligible for the Runs on Atlassian program.
• We operate no servers of our own and the App declares zero egress — it sends no data to any external host. You can verify this in the app manifest, which contains no external permissions block.
• All App data is stored in Forge storage within your Atlassian installation, encrypted at rest by Atlassian, and is never transmitted to the vendor.

Least privilege & access control

• The App requests read-only Confluence scopes only (pages, users, and groups). It never requests write access to your content.
• Interactive reads that surface information to a user run as that user (Forge asUser), so the App can never disclose a page, title, or link the requesting user could not already access. Permission checks fail closed: on any error, access is denied rather than granted.
• Administrative functions (tracking a page, viewing the compliance dashboard, exporting evidence) are gated behind a Confluence site-admin check.
• The App never reads or stores the body content of your Confluence pages, and never logs credentials, tokens, or API response bodies.

Secure development

• Source control is protected with multi-factor authentication, and changes reach production through pull requests.
• Dependencies are scanned for known vulnerabilities (npm audit, software composition analysis) before each release.
• Security-sensitive logic — including the permission checks above — is covered by automated regression tests.
• We maintain a written information-security policy and an incident-response plan.

Reporting a vulnerability

If you believe you have found a security vulnerability in the App, please report it to us privately at security@rethought.to. We will acknowledge your report, investigate promptly, and keep you informed of remediation. Please give us a reasonable opportunity to address the issue before any public disclosure. We will not pursue or support legal action against researchers acting in good faith under this policy.

Data handling & your rights

For details of exactly what the App stores, how it is processed, retention, and deletion on uninstall, see our Privacy Policy.

Contact

Security: security@rethought.to · General: tanzeel@rethought.to
Rethought · Lahore, Pakistan