Data Protection Toolkit security and technical FAQ

Last reviewed: 18 August 2026. This page answers the questions that come up in a security review of Data Protection Toolkit for Jira and Confluence. It is the same content our support team sends when a customer’s security or procurement team asks, published here so you do not have to ask first. The authoritative, continuously updated source for our security posture is the Actonic Trust Center.

The short version: on Atlassian Cloud the app reads your data through Atlassian’s public REST APIs, performs the scanning and matching in the user’s browser, and stores no personal data at all. What it retains is the ID of the search pattern and the ID of the location where a match was found, never the matched content itself. Actonic Products GmbH is ISO 27001 certified.

Data handling

What data does the app access, process or store?

The app can access the Jira and Confluence data that falls inside the search scope you define: issues, fields, comments, pages, spaces, page history and attachments. It does not store personal data, either inside our infrastructure or outside Jira and Confluence. The scan is: define the scope, add search patterns, add the actions to run against matches, run the search, review the results.

Does the app store the personal data it finds?

No. It does not store the matched content. It stores the ID of the search pattern and the ID of the location where the match occurred, which is what the results view needs in order to take you to the finding. The personal data itself never leaves your Atlassian instance.

How does the app read and change data?

Through the public Jira and Confluence REST APIs, using the authorisation and security mechanisms Atlassian provides for apps. There is no direct database access and no side channel.

Does the app support data residency?

No. The app does not currently support Atlassian’s data residency options. If your organisation has a pinning requirement for a specific region, raise it with us before you buy rather than after, because it is a real constraint and we would rather you hear it from us.

Does the app expose its own REST API?

No. The app does not publish REST APIs of its own.

Security

How is data protected in transit and at rest?

Both apps are available over SSL only, using a valid browser-trusted certificate rather than a self-signed one, with no manual intervention in the certificate process. All communication between the client, the Jira or Confluence instance and the app is encrypted.

How is one customer’s data separated from another’s?

The Cloud apps use the mechanism Atlassian calls tenant context, managed by the Tenant Context Service, to isolate customers logically. In practice that means each customer’s data is segregated at rest, and every request is processed within a tenant-specific view, so one tenant’s activity cannot reach or affect another’s.

Which authentication methods are supported?

The app works with the Jira and Confluence authentication system and supports whatever authentication settings your instance uses. It does not maintain a separate identity store or its own login.

How is security monitored?

  • Role-based access to each part of the infrastructure, separately.
  • A detailed event log for analysis and investigation.
  • Regular review of those logs, both to improve alerting and to identify incidents manually.

How often is security testing performed?

Once per quarter, as part of our internal audit process.

What is the security incident process, and who do I contact?

For any suspected security issue with the app, contact [email protected]. Our full security incident management plan is not published, but it is available to customers under review as part of a formal assessment. Ask through the Trust Center.

What certifications does Actonic hold?

Actonic Products GmbH is ISO 27001 certified. Worth being precise about what that means for you: it is a statement about how we run our own information security management system, not a compliance outcome the app delivers to you. The app helps you meet GDPR, HIPAA, CCPA and LGPD obligations; our ISO 27001 certificate tells you what kind of vendor you are buying from.

Access control and usage

Who can use the app inside our instance?

Administrators only, using the host product’s built-in permission model. In Jira, access is governed by the Administer Jira global permission. In Confluence, by the Confluence admin global permission. There is no separate app-level user list to maintain.

Can we restrict access by IP?

Yes, through your Jira or Confluence security configuration rather than through the app. IP allow listing is an Atlassian Premium feature on Jira Software, Jira Service Management and Confluence.

Which browsers are supported?

The latest stable versions of Microsoft Edge, Mozilla Firefox, Google Chrome on Windows and macOS, and Safari on the latest macOS release.

Which licence tier do we need?

The app tier must match your host product tier. A 25-user Confluence licence needs the app at the 25-user tier. For Jira, match the highest Jira application tier you hold: a 500-user Jira Software licence alongside a 20-agent Jira Service Management licence means the app must be licensed at 500 users. This is an Atlassian rule that applies to every Marketplace app, not an Actonic policy. See pricing.

Where this information comes from

The answers above are drawn from our product documentation and from the Privacy and Security questionnaire we file with Atlassian, which is shown on each Marketplace listing:

If your review needs something that is not answered here, ask us directly. We would rather answer a hard question early than lose your time in a procurement cycle.

Formerly known as Data Protection and Security Toolkit, and previously as GDPR (DSGVO) and Security for Jira and Confluence. Published on the Atlassian Marketplace by Actonic Products GmbH.