Security
How Transom Diagrams handles your data.
Short answer: it stays inside your Atlassian site. This page gives the facts.
The short version
- Transom Diagrams is a Forge app. It runs on Atlassian's infrastructure.
- It is built to be eligible for Runs on Atlassian. Atlassian applies the badge itself.
- It uses no external servers. The app asks for no permission to call outside services.
- It stores no data outside your Confluence page. We hold no copy.
Where each piece of data goes
- Diagram source
- Saved in the macro on your Confluence page, on Atlassian's infrastructure. It is drawn in your browser, inside the Forge app frame. It is never sent to Transom or to a third party.
- Rendering engines
- PlantUML and Mermaid are open-source libraries inside the app package. They run in your browser. Nothing is downloaded when a page loads.
- PNG for exports
- When you save, the app creates a PNG of the diagram and uploads it to the same page as an attachment, as you. It uses the page's normal permissions. This is how PDF and Word exports show the diagram.
- Our servers
- None for this app. We run no backend that receives your content, so we have no copy of it.
- Analytics
- None in the app.
- Data residency
- Your data stays in the Atlassian products that already hold your Confluence content.
Permissions the app asks for
| Scope | Why |
|---|---|
write:confluence-file | To attach the export PNG to the page, as the person who saves. |
read:attachment:confluence | To look up the attachment's file ID after upload, when the upload response does not include it. |
The app declares no external network permissions. It does not read your other pages.
Vulnerabilities and incidents
Report a security problem to [email protected] with "Security" in the subject. We follow the fix deadlines of the Atlassian Marketplace security program: critical issues within 10 days, high within 4 weeks, medium within 12 weeks, and low within 25 weeks. We report security incidents to Atlassian as the Marketplace partner agreement requires.
This website
transomapps.com sets no cookies and runs no scripts. It has no analytics, no trackers and no third-party requests. Fonts are served from this site. Our host, Cloudflare, handles standard network-level request processing.
Questions about your security review? Email [email protected]. We will answer questionnaires about how the app handles data.