PocketQuery on Confluence Cloud is built on Atlassian Forge. Your Confluence page content remains stored in Atlassian Cloud; PocketQuery does not copy or persistently store your Confluence pages or general Confluence content.
1. Is our data stored on your side, or only processed online and stored in Atlassian Cloud?
It depends on the type of data:
|
Data type |
Where it is stored |
Retention |
|---|---|---|
|
PocketQuery configuration (queries, datasources, templates, converters, app settings) |
Atlassian Forge Storage (KVS), managed by Atlassian as part of your Confluence Cloud installation |
Until you delete it or uninstall the app |
|
Datasource credentials (passwords, API keys, OAuth tokens) |
Atlassian Forge encrypted secrets (Atlassian-managed) |
Same as above |
|
Confluence page content |
Atlassian Cloud only - PocketQuery reads page context at execution time but does not store it |
N/A |
|
Data from your external SQL databases / REST APIs |
Processed transiently during query execution; results are cached for up to 30 minutes on our AWS infrastructure (DynamoDB), then automatically deleted |
Maximum 30 minutes |
|
User display names & roles |
Fetched from the Confluence API at runtime; not persistently stored by PocketQuery |
N/A |
In summary: Your PocketQuery configuration and credentials are stored in Atlassian-managed Forge Storage, not on Lively Apps’ own servers. Data retrieved from your external databases is not permanently stored by PocketQuery - it is fetched live, briefly cached (30 min.), and then discarded. Your Confluence content stays in Atlassian Cloud.
2. If data is stored on your side, is data residency within the EU?
-
Configuration & credentials: Stored in Atlassian Forge Storage, which follows Atlassian Cloud’s data residency for your Confluence site. If your Confluence Cloud instance is hosted in the EU, this data resides within Atlassian’s EU infrastructure.
-
Transient query results (30-minute cache) and query execution: Currently processed and briefly cached on Amazon Web Services (AWS) in the United States. This data is not stored long-term (maximum 30 minutes). We are actively working on customer-configurable data residency, so that you will be able to choose between EU and USA for this processing in the future.
-
Optional product analytics: If enabled, strictly metadata-only analytics events are sent to PostHog EU Cloud (Frankfurt). No query text, results, usernames, or personal data are included.
Transfers of personal data to the United States are governed by appropriate safeguards as described in our Data Processing Addendum (DPA) (e.g. EU Standard Contractual Clauses and/or EU–U.S. Data Privacy Framework).
3. Is any of our data shared with or processed by subcontractors or sub-processors?
Yes, but only to the extent necessary to operate the app:
|
Sub-processor |
Purpose |
Data involved |
|---|---|---|
|
Atlassian |
Forge platform, app storage (KVS), Confluence API |
Configuration, credentials (encrypted), audit metadata |
|
Amazon Web Services (AWS), USA |
Query execution (Lambda) and transient result cache (DynamoDB) |
Query results during execution (max. 30 min.); no long-term configuration storage |
|
PostHog EU (optional) |
Product analytics (usage metadata) |
Pseudonymized tenant/query IDs, success/failure flag, datasource type, duration bucket - no SQL, query text, results, or personal data |
All sub-processors are contractually bound to data protection and security standards consistent with our Data Processing Addendum.
4. Overview of main security measures
Storage & encryption
-
Datasource credentials are stored in Atlassian Forge encrypted secrets, separate from entity metadata.
-
Each Forge app installation has isolated storage (tenant separation at the Atlassian platform level).
Access control
-
All privileged operations are enforced server-side in Forge resolvers with role-based authorization (Viewer / Editor / Admin).
-
Datasource credentials are accessible only to users with Editor or Admin permissions.
-
Audit fields (
createdBy,updatedBy) are set server-side; client-supplied values are ignored.
Query execution
-
Query results in the temporary cache are bound to the executing user’s Atlassian account ID; access is rejected if the requesting user does not match.
-
Results are automatically deleted after 30 minutes.
-
SSRF protection: REST datasource connections block private/reserved IP ranges to prevent access to internal networks.
Authentication
-
Communication between Forge, our execution infrastructure, and result retrieval uses JWT-based authentication with the user’s Atlassian account ID as principal.
Analytics privacy
-
Analytics is fail-closed: no events are sent unless explicitly configured.
-
Only metadata is transmitted; query text, parameters, results, page IDs, and personal data are never sent.
-
Identifiers are pseudonymized before leaving the app.
-
PostHog person profiles and GeoIP are disabled.
Data lifecycle
-
Configuration data is deleted when you remove entities or uninstall the app (subject to Atlassian’s Forge storage lifecycle).
-
Transient query results expire automatically after 30 minutes.