Baselines All documentation pages
Security & data residency
Baselines runs on Atlassian's Forge platform. Its records are stored by Atlassian, not by us. Your page content leaves Atlassian in one case and only while it is happening: a PDF export, which is rendered by a service pluginDevs operates on Amazon Web Services. Apart from that, Baselines sends only usage analytics. This page sets out what goes where.
Your page content is read from Confluence when you view, compare, export or republish a baseline, and is not kept afterwards, except while an export is being built (deleted within two days if it is not finished) and an exported PDF (deleted within an hour). It leaves Atlassian in one case: a PDF export. Everything else (the baseline records, releases, schedules, permission settings and the log of who did what) stays in Atlassian's own storage. Apart from an export, the only data Baselines sends outside Atlassian is usage analytics, marked with your site and never with a person (see Analytics).
Where your data lives
Baselines is a Forge app. It runs inside Atlassian's platform and stores its records in Forge SQL, Atlassian's own hosted database for apps, which Atlassian keeps in the same place as your Confluence site's app data. Those records are baseline entries, the documents and releases they are grouped into, scheduled-baseline configurations, permission assignments, app settings and a log of who did what in the App.
A baseline record holds references to your pages, the space, and who created it and when. It is not a permanent copy of your page bodies. Page content and attachments are read from Confluence on demand, as you, each time you view, compare, export or republish a baseline. While an export is being built, the pages it has collected are kept in Forge hosted storage so that it can be resumed; if it is not finished, they are deleted within two days.
These are also held in a stopped database pluginDevs operates on AWS. Nothing is written to it or read from it, and it keeps them until we delete them.
App permissions
Baselines asks for the Confluence permissions it needs and no more, and a Confluence administrator reviews and approves them. Because Baselines acts as you, it can only ever read what you can already read.
| What it may do | Why Baselines needs it |
|---|---|
| Read spaces, pages, blog posts, attachments and the other content types a page tree can contain | Capture a page tree into a baseline, and read each page back at the version the baseline recorded. |
| Read users and groups | Show who took a baseline, and resolve the group-based access rules you configure. |
| Create a page and its attachments | Only for Republish, which publishes a baseline into Confluence as a new page. Baselines never overwrites or deletes your existing content. |
| Read how Confluence renders a page | So that a Jira issue macro comes out of an export with its summary and status, through your site's own Jira connection. |
A permission Baselines did not have before is never granted silently: a new one waits for a Confluence administrator to approve it, and until then the feature that needs it simply does not run.
What data is processed and where
| Data | Used for | Stored? |
|---|---|---|
| Confluence page content & attachments | Building, viewing, comparing, exporting and republishing baselines | Read on demand; during an export, kept in Forge SQL until it finishes (at most two days) |
| Baseline records (page references, space, versions, dates) | Identifying and re-serving a snapshot | Forge SQL, held by Atlassian |
| Releases, schedules, permissions, settings and the log of who did what | Your Baselines configuration and its history | Forge SQL, held by Atlassian |
| Who created a baseline and who did what, with display names | Showing who created a baseline; readable names | Forge SQL, with the baseline record |
| The assembled document and its images, during an export | Producing the PDF | Transient on the rendering service; see below |
PDF export and the rendering service
Baselines assembles the document itself, inside Forge, and sends it with its images to a rendering service pluginDevs operates on AWS, in the United States. That service turns it into a PDF and hands back a link. This is the one path on which your page content leaves Atlassian, and the files it produces are deleted within an hour of the export. Controls on it:
- The document is deleted the moment the renderer has read it, and the images once the render has used them. The finished PDF, and any files left by an export that was interrupted, are deleted automatically within one hour.
- Both the upload and the download use short-lived links to private storage, which is not public and cannot be browsed.
- Requests to the service are authenticated and carried over HTTPS.
- The service restricts what it fetches, so it can only retrieve the expected content.
- The service is monitored for threats, and alerts reach us as they occur.
Transport & authentication
Baselines reads and writes Confluence through Atlassian's own APIs, as the signed-in user, using tokens the Forge platform issues. We never hold a password, and we never ask for an API token, for Confluence, for Jira or for anything else. All traffic between the app and the rendering service is over HTTPS. Access to the rendering service is restricted to pluginDevs.
Analytics
Baselines sends usage events to an Atlassian-approved analytics tool, such as that a screen was opened or a baseline was frozen, marked with your site so we can tell sites apart, never with a person. They never carry page content, page titles, baseline names, names, email addresses or account ids. Your Atlassian administrator can turn this off in Atlassian Administration (Connected apps, then Baselines), and Baselines keeps working normally.
Sub-processors & data residency
| Sub-processor | Role |
|---|---|
| Atlassian | The Forge platform the app runs on, Forge SQL where its records are stored, and Confluence Cloud itself. |
| Amazon Web Services (US) | The PDF rendering service. It receives only the pages you export, and only while an export is being made. |
| PostHog Inc. (US) | An analytics product on Atlassian's pre-approved allowlist: usage analytics, as described above. No Confluence content. |
Because rendering happens in the United States, a PDF export is the one operation in which your page content is processed outside the location Atlassian holds your site's data in. Nothing is retained there: see PDF export above.
No advertising vendor is introduced anywhere, and no Confluence content is ever sent to an analytics service.
Reporting a vulnerability
If you find a security vulnerability in Baselines, please report it to us privately at admin@plugin-developers.com and do not disclose it publicly until we have had a chance to fix it. Please include the affected part (the Forge app, or the PDF rendering service at export.baselines.plugin-developers.com), a description and its impact, the steps to reproduce it, and the Confluence site you used. We aim to acknowledge a report within two business days and to keep you informed while we fix it.
Most worth your attention: any way one Confluence site reaches another site's data; any way around the Baselines permissions or Confluence site administration checks; SSRF or injection, especially where page content reaches the PDF renderer. Not in scope: denial of service against your own site only, findings that need a compromised Atlassian or AWS account, and scanner output without a demonstrated impact.
Safe harbour. We will not pursue or support legal action against anyone who reports a vulnerability in good faith and in line with this policy: testing only against sites you control, not accessing or changing other customers' data, not degrading the service for others, and giving us reasonable time to fix an issue before disclosing it. You can also report through Atlassian's Marketplace security programme; writing to us directly is the fastest route to a fix. Our security.txt lists the same contact.
Privacy & terms
Baselines is published by pluginDevs. We do not sell, rent or disclose your data except to the sub-processors above as needed to run the service, or as required by law. For the full statements see the Privacy Policy and Terms of Service, or contact support@plugin-developers.com.
Was this page helpful? Yes · No · Contact support