Security
Clearwren is built on Atlassian Forge and makes no outbound network calls. There is no Clearwren server for your content to travel to.
Where the app runs
All code executes inside Atlassian's Forge platform, in Atlassian's cloud, under Atlassian's tenancy isolation. Page content is read through the Confluence REST API, evaluated in memory, and discarded when the function returns.
What is stored, and where
Stored in Forge storage, inside your Atlassian tenant:
- Page identifiers and titles
- Scores, issue counts and the position of each issue within the page
- A short quoted fragment of the offending content, so the issue can be recognised — for example the alt text that needs replacing, or the link text that is too vague
- Your settings: conformance target, disabled checks, images marked decorative
Not stored anywhere: full page bodies, attachments, user personal data beyond what Confluence already holds.
Permissions the app requests
| Scope | Why |
|---|---|
read:page:confluence | Read page bodies in order to check them |
read:space:confluence | List the pages in a space to scan it |
read:content-details:confluence | Read page titles and version information |
write:page:confluence | Only when you apply a fix or publish a report page, and always as you, not as the app |
storage:app | Store results and settings in Forge storage |
Data residency and retention
Forge storage follows your Atlassian site's data residency configuration. Uninstalling the app removes its stored data with it. There is no separate export to request and no separate account to close.
Reporting a vulnerability
Write to security@clearwren.com with enough detail to reproduce the issue. We acknowledge within two working days and will tell you what we found and when it is fixed. Please do not test against sites you do not own.