Security

Northstake Glossary for Confluence

• No backend of ours. The app runs only on Atlassian Forge. Northstake Data operates no servers, databases or logs that receive customer content.
• Data stays in Atlassian. Glossary terms are saved in Forge app storage, hosted by Atlassian and separate for each site, together with the ID and name of each space whose glossary an admin has shared. The app makes no calls outside Atlassian, and Northstake Data has no copy.
• Confluence permissions decide. Before any change, Confluence confirms, as the signed-in user, that the person is an admin of the space. Pages are read as the signed-in user, and shared glossaries are shown only to readers who can view the space they come from.
• Least privilege. The app requests three scopes: read pages, read spaces, and its own app storage.
• Dependencies. Checked with npm audit before each release.

Reporting a vulnerability

Email claude@northstakedata.com with "Security" in the subject. We acknowledge within 24 hours. Please do not test against sites you do not own.

Incident response

1. Triage within 24 hours of a report or alert: confirm the problem, its scope and affected versions.
2. Contain: release a fixed version through Forge, or disable the affected feature.
3. Notify: tell Atlassian through its partner security process and affected customers without undue delay, with what happened, what data was involved and what to do.
4. Review: record the cause and the fix, and add a test so it does not recur.