Security at a Glance
Every DataPingo app is built on Atlassian's Forge platform and acts as you, with your permissions. All app infrastructure, hosting, encryption, and runtime security is provided and managed by Atlassian; your content never leaves Atlassian and no data is kept on DataPingo systems. We do not hold any third-party security certifications (such as SOC 2, ISO 27001, or PCI-DSS) independently — our apps' security posture is inherited from and governed by Atlassian's platform.
1. Platform & Infrastructure
1.1 Atlassian Forge
All DataPingo apps are built on Atlassian Forge — Atlassian's hosted serverless platform. This means:
- No external servers for app data: Our apps do not use any servers, databases, or cloud infrastructure outside of Atlassian.
- No data egress: App code runs inside Atlassian's infrastructure. Data never leaves Atlassian's environment to reach DataPingo systems.
- Atlassian-managed security: Encryption, network security, runtime isolation, and infrastructure hardening are all handled by Atlassian.
- Automatic updates: The Forge runtime receives security patches from Atlassian automatically.
For full details on Atlassian's infrastructure security, see atlassian.com/trust/security.
2. How Every DataPingo App Handles Your Data
These rules apply to every app DataPingo publishes, including future ones. An app that cannot meet them is not released.
- It acts as you. Every read and write is made with your own Atlassian account and your existing permissions. An app cannot reach an issue, page, or space that you could not reach yourself, and what it creates is authored by you.
- Nothing leaves Atlassian. Apps declare no external egress. Your content is never sent to DataPingo or to any third party.
- No data is kept. Apps keep nothing on DataPingo systems. When an action needs working data while it runs — files waiting to be posted, or a copy of the page being cloned — it stays in your own Atlassian site's Forge storage and is deleted when the action finishes. Anything left behind by an interrupted action expires automatically.
- Minimum permissions. Each app requests only the Atlassian scopes it needs, listed below and on the Privacy & Security tab of its Marketplace listing.
- Logs carry no content. Our developer logs record app activity — when an action ran, on which Atlassian site, how many items it touched, IDs, sizes, timings, and error codes — with names, titles, and issue, comment, or page content redacted or never logged.
2.1 App-by-App Reference
The specifics for each app. When a new app is released, it is added here first.
| App | Atlassian scopes | Working data while an action runs |
|---|---|---|
| Bulk Comments for Jira | read:jira-workwrite:jira-work allowImpersonationread:jira-userstorage:app |
Files you attach are held in Atlassian's Forge Object Store until they are posted to each selected issue, then deleted; files that are never sent expire within one hour. The progress of each send is tracked until it completes. Writing uses impersonation so that large files, which finish uploading after you have moved on, are still posted as you. |
| Bulk Page Cloner for Confluence | read:page:confluenceread:space:confluenceread:label:confluencewrite:page:confluencewrite:confluence-contentstorage:app |
A copy of the page you are cloning, kept while the clone run is in progress and deleted when it ends (it expires after seven days if a run is abandoned). Your list of pages is cached for up to one hour so the page picker loads quickly. |
| Page Order for Confluence | write:confluence-contentwrite:page:confluenceread:hierarchical-content:confluenceread:page:confluenceread:folder:confluenceread:space:confluencesearch:confluence |
None. Page Order stores nothing: it reads the page tree while you have it open and saves your changes as you, with no copy kept anywhere. |
2.2 GDPR & Personal Data
Because DataPingo apps run entirely on Atlassian Forge and declare no external egress, no end-user data is processed or stored outside Atlassian's infrastructure. On each app's Marketplace listing we have declared, and Atlassian has approved, that DataPingo is neither a data controller nor a data processor under the GDPR with reference to that app. Those declarations are public on the Privacy & Security tab of every listing.
An app may read personal data in the course of its job — resolving a name for an @mention, for example — but it does not keep it beyond the working data described above, and uninstalling an app removes anything it holds.
The personal data DataPingo itself holds — mainly business contact details — is covered by our Privacy Policy, together with your rights over it.
3. Atlassian Marketplace Trust & Compliance
All DataPingo apps are reviewed and listed on the Atlassian Marketplace. By listing on the Marketplace, apps must comply with:
- Atlassian Marketplace Partner Agreement
- Atlassian Privacy Policy
- Atlassian's data residency, security, and personal data reporting requirements
DataPingo does not hold independent certifications such as SOC 2 Type II, ISO 27001, or PCI-DSS. Security assurances are provided through Atlassian's platform compliance.
4. Access & Permissions
DataPingo team members do not have access to your Atlassian data. App code runs in an isolated Forge sandbox within Atlassian's infrastructure — DataPingo cannot query or extract tenant data outside of what the app surfaces to the authenticated user.
5. Incident Response
If you discover a security vulnerability or data concern related to a DataPingo app:
- Email security@datapingo.com with a description of the issue. Please do not open a public issue or post details anywhere public until we have had a chance to fix it.
- A confirmed security issue is treated as Critical, so you will hear from a person within 1 business day and we will give you a resolution timeline then. Response targets live in one place — the table in our Service Level Agreement.
- For platform-level security issues (Forge infrastructure, Atlassian APIs), please also report to Atlassian's bug bounty program.
- Not sure whether something is a security issue? Open a request on the support portal and we will route it. If it turns out to be a vulnerability, please move the conversation to security@datapingo.com rather than leaving details in a portal request.
6. Policy Updates
This page is updated when DataPingo's data handling practices change or a new app is released. Material changes will be announced via our website. Continued use of our apps constitutes acceptance of the current policy.
Contact
- Questions about this policy: contact@datapingo.com
- Vulnerability reports & security incidents: security@datapingo.com
- Support portal: Open a request
- Legal: Privacy Policy · Terms of Service
Last updated: October 20, 2026