Trust & security
Every Datum app is built to be safe by default — isolated per install, verified on every request, and dependable in the state it owns.
Isolated per install
An app's stored data is scoped to a single install (site + app). On Atlassian Forge, storage is per-install and per-environment — so one site's install can never read another's data.
Every request verified
The app trusts nothing by default: every Forge invocation carries a signed Atlassian-issued token verified against the app before any data is shown, and every inbound webhook is checked against its signing secret before it's acted on.
Dependable state, on the record
Where an app owns a decision — an approval, a sign-off — that state lives with the app so a stray automation can't silently overwrite it, and Rewind keeps the full field-change history on the record.
Per-install isolation
Each site's data is walled off. An app's storage on Atlassian Forge is scoped to the current install and environment, and every read and write runs within that scope, so one site's install can never reach another's data. Isolation is a property of how the data is stored, not a promise in a policy.
Verified requests
Nothing is trusted on face value. When a module loads, the short-lived invoke token Atlassian hands the app is verified against the app's client secret before any data is shown. When a webhook fires, the request's signature is checked against the app's signing secret before it changes anything — a forged or replayed call is rejected.
Dependable state & audit
The worst way state can fail is to silently revert. Where a Datum app owns a decision, that decision is app-owned state — it isn't a Jira field or Confluence page a stray automation can clobber. Rewind keeps the full field-change history Jira's native view drops, and Signet records every sign-off — both exportable on Standard.
Data protection & hosting
Datum apps run on Atlassian Forge, Atlassian's cloud platform for marketplace apps; any data an app stores is held in that infrastructure within your Atlassian site's tenancy. We process personal data under our Privacy Policy and, for the issue and page data an app handles on your behalf, our Data Processing Agreement — which lists our sub-processors. When you uninstall an app, we delete the data we hold for it.
Access & encryption
Data is encrypted in transit. Access to production is on a least-privilege basis and scoped to what operating the service requires. Each app requests only the Atlassian scopes its function needs.
Responsible disclosure
Found a security issue? Email support@datadir.co with the details and steps to reproduce. Please give us a reasonable window to fix it before disclosing publicly; we're grateful for reports and will credit you if you'd like.