Your security review will be short.

Where your data lives

Each macro stores one JSON document in its own configuration parameter. That parameter is part of the page, exactly like any other macro parameter, and it travels with the page wherever the page goes.

The consequence worth spelling out: the app has no copy of anything. There is no database to breach, no export to request, no retention period to agree and no deletion request to process, because there is nothing held anywhere except in your own Confluence content.

• Page restrictions apply, unchanged — there is no second permission model
• Page history records macro changes like any other page change
• Copy, move, templates, space export and trash restore all work with no code on the app’s side
• Uninstalling removes the app; your page content is untouched

Getting your records out, with or without us

Uninstall and the macros stop rendering: Confluence shows its placeholder and the stored document stays in your page source, structured and readable. That is the whole of the lock-in, and it is worth being precise about it rather than leaving “your data lives in the page” as a reassurance.

Each record is one JSON document under a single macro configuration parameter, carrying a schema version. Ask and we will send you the schema, so your own team can turn every record back into a table without the app and without us.

Change control

Forge applies a minor version to installed sites without asking. A change that adds a scope or an external permission does not apply until an administrator approves it, and a change to remotes does in most cases — this app declares none of those, so any future version that did would stop and ask you first.

What an unapproved update can do: change the app’s own code. What the macros show, what they write into a page when an author saves, and what they log. It cannot reach anything the app does not already have permission to reach, which is nothing outside the page — but within that, it arrives without asking.

And how it gets there. The vendor deploys to production by hand, from its main branch, after automated checks have passed on that commit. No automated system holds a credential that can deploy. That is a release procedure, not a technical lock. If four eyes on every production change is a control your process depends on, ask for it in writing before you install, not after.

What the app asks for

A page view runs no function at all: the app declares no resolver on the view path, so there is nothing to invoke, however many macros sit on the page. That follows from the manifest, which you can read above — it has not been measured on a live site with twenty macros, and we would rather you knew which of the two this is.

What has not been done

Stating this is the point of the page. A security section that lists only strengths is not evidence of anything.

• No third-party penetration test
• No CAIQ Lite questionnaire
• No SOC 2, ISO 27001 or other formal compliance certification
• No formal accessibility audit, and no VPAT
• No Runs on Atlassian badge yet — see above

What there is instead is an app with no server, no database and no network calls, whose entire attack surface is what Confluence already exposes — and the whole of it described on this page rather than summarised. The source is proprietary and the repository is private, so we cannot offer you a source review; what we can do is answer any question on this page in writing.

Accessibility, described rather than claimed

These are decisions visible in the code. They are not an audit.

• Colour never carries meaning alone — the letter is inside the RACI label, the word is inside the RAG lozenge, and an overdue action is red and carries the word “Overdue”
• Every colour, space and radius is an Atlassian design token, so the macros follow the reader’s theme
• No two controls in a dialog share an accessible name — fields are named for their row, and each row carries its own heading
• Confirmations are inline, never a second modal competing with the host dialog for focus; the safe button is first and takes the focus
• Character limits count user-perceived characters, so a cap cannot cut an emoji in half or drop a combining mark
• Wide tables scroll inside the macro, never the page, and every table carries a label

And the limits, which are real

These come from the UI Kit components the macros are built from, and are published rather than left to be discovered.

• Tables have no row headers — the component offers no way to mark one
• The scroll area around a wide table cannot be reached by keyboard alone, and its region has no name
• Nothing that appears mid-edit is announced to a screen reader: no component exposes a live region
• Focus cannot be moved programmatically, so removing a row does not move the focus anywhere sensible
• A macro title is always a level-three heading, whatever the page around it is doing

The full account, with what each one means in practice, is in the Confluence administrator’s guide and the reader’s guide.

One scope note, because it matters: the statements above describe the app. This website is a separate thing. It is checked with an automated accessibility test — every route, in both themes, at desktop and phone width, with every disclosure opened first, run against the built site with npm run a11y. It last ran on 4 October 2026, with no violations. An automated test finds what a machine can see and nothing else: it cannot judge whether a heading is the right heading or whether alt text describes the right thing. Neither the app nor the site has had a human audit.