Skip to content
Ovrid Labs
Back to home

Last updated: May 18, 2026

Security Policy

Ovrid Labs develops Atlassian Marketplace apps built exclusively on Atlassian Forge. This security policy describes how we secure our apps, manage vulnerabilities, and handle security incidents.

Architecture security

All Ovrid Labs apps run on Atlassian Forge, a serverless platform hosted and managed by Atlassian. This architecture provides inherent security advantages:

  • No self-managed infrastructure: our apps do not run on external servers, VMs, or containers. All execution happens within Atlassian’s Forge runtime.
  • No external data transfer: our apps make zero outbound network calls. All data stays within Atlassian’s infrastructure.
  • No credential storage: our apps do not require or store API keys, passwords, personal access tokens, or any form of shared secrets from end users.
  • Least-privilege scopes: each app requests only the permissions it needs. UserLens operates with read-only scopes and cannot modify content. ConfluClean uses write access solely to perform the content lifecycle operations you configure, such as archiving and restoring pages, acting only on your defined rules and schedules.
  • Forge sandboxing: each app invocation runs in an isolated sandbox with strict resource limits enforced by Atlassian.

Data security

  • Storage: all app data is stored in Atlassian Forge Storage (KVS and SQL), encrypted at rest by Atlassian.
  • Transmission: all data in transit uses TLS encryption provided by Atlassian’s infrastructure.
  • Isolation: each customer’s data is logically isolated per Atlassian site. No cross-tenant data access is possible.
  • Minimal data collection: we store only the data necessary for app functionality (user identifiers, activity timestamps, scan results, configuration settings). We do not store email addresses, passwords, or sensitive personal information.
  • Data deletion: all app data is automatically deleted by Atlassian when the app is uninstalled.

Vulnerability management

  • Dependency scanning: we run npm audit (or equivalent) on every release. Critical and high-severity vulnerabilities are resolved before deployment.
  • Forge platform updates: the Forge runtime is maintained and patched by Atlassian. We benefit from their security updates automatically.
  • Code review: all code changes are reviewed before deployment to production.
  • Scope minimization: we follow the principle of least privilege. Every permission scope in our manifest has an active code path. Unused scopes are removed.

Incident response

If a security vulnerability or incident is identified in one of our apps:

  1. Identification: issues can be reported by customers via security@ovrid.io, by Atlassian, or discovered during internal review.
  2. Triage: upon receiving a report, we assess severity and impact within 24 hours.
  3. Containment: for critical issues, we deploy a fix or disable the affected functionality within 48 hours.
  4. Resolution: a patched version is deployed through the standard Forge deployment pipeline and distributed automatically via the Atlassian Marketplace.
  5. Communication: affected customers are notified through the Marketplace listing changelog and, for critical issues, via direct communication.

Security issue reporting

Customers and security researchers can report security issues to:

We acknowledge security reports within 24 hours and provide a resolution timeline within 72 hours.

Access control

  • Source code: stored in a private repository with access limited to authorized developers.
  • Deployment: only authorized team members can deploy to staging and production environments via the Forge CLI.
  • Marketplace management: access to the Atlassian Marketplace vendor portal is restricted to authorized administrators.

Compliance

  • Our apps are designed to be compatible with customer compliance requirements by minimizing data collection, requesting least-privilege scopes, and keeping all data within Atlassian’s infrastructure.
  • We do not currently hold SOC 2, ISO 27001, or equivalent certifications. Our security posture relies on Atlassian Forge’s platform-level certifications and controls.
  • For information about Atlassian’s infrastructure security certifications, refer to Atlassian’s Trust Center.

Policy updates

This policy is reviewed and updated as needed. Material changes are reflected in the “Last updated” date above.

Contact

Ovrid Labs