Skip to content
Book call

Security Policy

How Fragon Studios builds, operates and secures its Atlassian Marketplace apps.

Security Policy

Last updated: 10 August 2026

Scope

This security policy describes the technical and organisational measures Fragon Studios e.U. applies to the development and operation of its Atlassian Marketplace apps, currently Datawall for Confluence Cloud and Jira Cloud. It is the policy referenced from our Atlassian Marketplace listings.

It complements the Datawall privacy policy and our general privacy policy. Fragon Studios e.U. is a company registered in Austria; company details are in our imprint.

Security by architecture

Our most important security control is what we do not build. Our apps run entirely on the Atlassian Forge platform inside the customer’s own Atlassian environment. There is no Fragon Studios backend that customer data could reach.

  • No egress: the app manifest declares no external permissions and no remote hosts. All processing happens in Forge functions inside the Atlassian tenant.
  • No external storage: app data is written exclusively to Atlassian-hosted Forge storage, scoped to the individual installation. Data residency follows the host product, including the EU and Germany.
  • No third-party assets at runtime: no CDN scripts, no remote fonts and no tracking in the app interface. Everything is bundled with the app.
  • Read-only access to product content. The app requests no write permissions for Confluence pages or Jira issues.
  • Every released version has been eligible for Atlassian’s Runs on Atlassian programme, which requires exactly these properties.

Protecting customer data

Because we never receive customer data, protection focuses on what the app stores inside the tenant.

  • Detected sensitive values are never stored in full. A finding keeps a masked snippet only; the remainder is replaced before anything is written.
  • Administrator identifiers in the audit log are pseudonymised with an HMAC, so the evidence trail holds no plain account IDs.
  • Application logs contain identifiers and error codes, never scanned content or detected values.
  • The attestation audit log is append-only and chained with SHA-256, which makes later modification detectable.
  • The app implements Atlassian’s Personal Data Reporting API. When Atlassian reports an account as closed, the stored account reference is erased.

Secure development

Changes reach customers only through a reviewed, automated pipeline.

  • Source code is kept in a self-hosted GitLab with multi-factor authentication enforced. The full history allows a rollback to any earlier state.
  • Every change runs type checking, linting and an automated test suite in CI before it can be deployed, including fixed reference test sets for the detection logic.
  • Dependencies are audited for known vulnerabilities on every change and additionally on a weekly schedule. Advisories are triaged and patched.
  • Deployments run from CI with credentials held as protected, masked variables. No secrets are stored in the repository.
  • Releases pass through a staging environment before production.

Access control and company security

Fragon Studios is a small, owner-operated company. Access to production systems is limited to the people who need it, and today that is a single named person.

  • Multi-factor authentication on every account involved in building and publishing the apps, including Atlassian, source control and email.
  • Credentials are held in a password manager and are never shared by email or chat.
  • Development workstations use full-disk encryption, endpoint protection and prompt operating system patching.
  • Access to the Marketplace partner account is limited to the accounts that require it and is reviewed whenever the team changes.
  • We have no access to our customers’ Atlassian environments or to the app data stored in them. Diagnosis relies on the information customers choose to send us.

Vulnerability management and responsible disclosure

If you believe you have found a security vulnerability in one of our apps, please report it to support@fragonstudios.com with enough detail to reproduce it, and please do not disclose it publicly before it is fixed. We will not pursue legal action against anyone who reports in good faith and does not access, modify or delete other people’s data.

We acknowledge security reports within two business days. Confirmed vulnerabilities are fixed within the deadlines of the Atlassian Marketplace Security Bug Fix Policy for cloud apps, counted from the report or triage:

  • Critical (CVSS 9.0 and above): within 10 days
  • High (CVSS 7.0 and above): within 4 weeks
  • Medium (CVSS 4.0 and above): within 12 weeks
  • Low (CVSS below 4.0): within 25 weeks

Security incident response

We maintain a written incident response plan that is reviewed at least annually and after every incident. In an incident the following applies:

  • A named responsible person assesses and classifies the report and keeps a timestamped incident log.
  • Containment for a Forge app means deploying a corrected or last known good version and rotating any affected credentials.
  • For critical and high severity incidents Atlassian is notified within 24 hours of identification through a P1 ticket in the Marketplace support portal, and kept updated at least every six hours until the issue is resolved.
  • Affected customers are notified within 72 hours when their data or their security is affected.
  • Where an incident is a personal data breach, our customers are the controllers under the GDPR and we supply the facts they need for their own notification duties.
  • A root cause analysis is completed within five business days of resolution, and the preventive measures are tracked to completion.

Certifications and independent assessments

We state our position openly rather than implying more than we have. Fragon Studios currently holds no ISO 27001 or SOC 2 certification, has not commissioned an external penetration test, and does not take part in the Atlassian Marketplace Bug Bounty Programme.

That is a deliberate consequence of the architecture. Our apps hold no customer data outside the customer’s own Atlassian tenant, and we run no servers, no network and no backend that such an audit would examine. The security of the data therefore rests on Atlassian’s certified platform and on the app-level controls described above. We will reassess this as the product and the company grow.

Subprocessors

We use no subprocessors for customer data, because we never receive customer data. Data processed by our apps stays inside the customer’s Atlassian Cloud environment, for which Atlassian is the provider. Our own business systems (email, source control, website) never come into contact with app data.

Contacting us about security

Security reports and questions: support@fragonstudios.com. This address is also registered as the security contact for our apps on the Atlassian Marketplace. Machine-readable contact details are published at /security.txt. Postal address and company details are in our imprint.

Changes to this policy

We review this policy at least once a year and update it whenever our practices or the platform change. The version published on this page applies.