Trust & security
Every Datum app is built to be safe by default — isolated per install, verified on every request, and dependable in the state it owns.
Isolated per install
An app's stored data is scoped to a single install (site + app). On Atlassian Forge, storage is per-install and per-environment — so one site's install can never read another's data.
Authenticated by the platform
Forge authenticates every app invocation and runs the app in an isolated, per-install sandbox. Our apps expose no public HTTP endpoints and no external webhooks, so there's no external surface to forge or replay; product events we act on are delivered by Atlassian inside its own trust boundary.
Dependable state, on the record
Where an app owns state — a stored template, a recorded decision — that state lives with the app so a stray automation can't silently overwrite it.
Per-install isolation
Each site's data is walled off. An app's storage on Atlassian Forge is scoped to the current install and environment, and every read and write runs within that scope, so one site's install can never reach another's data. Isolation is a property of how the data is stored, not a promise in a policy.
Authenticated by the platform
Nothing runs on face value. Forge authenticates every invocation of the app and executes it in an isolated, per-install sandbox on Atlassian's managed platform — the app declares only the scopes it needs, and Atlassian enforces them. Our apps expose no public HTTP endpoints and no external webhooks: any product event we act on (for example, "issue created") is delivered by Atlassian inside its own trust boundary, not from the public internet.
Dependable state & audit
The worst way state can fail is to silently revert. Where a Datum app owns state, that state is app-owned — it isn't a Jira field or Confluence page a stray automation can clobber. Each app that keeps a history or record documents what it stores, and where it's exportable, on its own Marketplace listing.
Data protection & hosting
Datum apps run on Atlassian Forge, Atlassian's cloud platform for marketplace apps; any data an app stores is held in Forge's per-install, per-environment storage — isolated to your install and never shared across sites. We keep no external data stores. Data residency: because an app's data lives only in Forge's hosted storage, Atlassian automatically pins it to your Atlassian product's region and migrates it if you change region (supported regions: EU, US, AU, DE, SG, CA, IN, KR, JP, GB, CH) — each app documents its in-scope data on its Marketplace listing. We process personal data under our Privacy Policy and, for the issue and page data an app handles on your behalf, our Data Processing Agreement — which lists our sub-processors. When you uninstall an app, we delete the data we hold for it.
Access & encryption
Data is encrypted in transit and at rest (Forge-managed encryption of app storage). Access to production is on a least-privilege basis and scoped to what operating the service requires. Each app requests only the Atlassian scopes its function needs.
Responsible disclosure
Found a security issue? Email support@datadir.co with the details and steps to reproduce. Please give us a reasonable window to fix it before disclosing publicly; we're grateful for reports and will credit you if you'd like.