Prometheus Agency — Security Policy

Effective date: July 17, 2026 · Applies to all Prometheus Agency apps on the Atlassian Marketplace, including Access Lens — Permissions Audit for Confluence and Answers — Q&A for Confluence.

This page describes how we, as the vendor, secure our apps and the systems used to build and operate them. For how each app handles your data, see the app's Privacy Policy (Access Lens · Answers).

1. Architecture: everything runs inside Atlassian

Our apps are built on Atlassian Forge and designed to meet the requirements of Atlassian's Runs on Atlassian program:

• All app code executes on Atlassian's own cloud infrastructure — we operate no servers, databases or third-party services that receive customer data.
• The apps make no network requests outside Atlassian (zero data egress).
• Customer content created by the apps (for example, questions and answers in Answers) is stored inside your own Confluence site and governed by your Atlassian organization's access controls and data-residency settings.
• Infrastructure security — network, hosting, encryption in transit and at rest, platform isolation — is provided by Atlassian's Forge platform (see Atlassian Trust Center).

This architecture deliberately minimizes the attack surface: there is no vendor-side system holding your data that could be breached.

2. Secure development practices

• Least privilege: each app requests only the minimum OAuth scopes it needs to function, and each scope is justified in the app's Privacy & Security tab on the Marketplace listing. We do not request write access where read access suffices.
• User-context permissions: wherever possible the apps act with the permissions of the current user (asUser), so no user can see or do more through our apps than Confluence itself allows them.
• Source control and review: all app code lives in private Git repositories. Every change is reviewed and tested (including automated offline test suites) before release.
• Dependency hygiene: dependencies are kept to a minimum, pinned, and audited with automated tooling (npm audit) before each release; we update promptly when advisories affect our dependency tree.
• No secrets in code: credentials and tokens are never committed to source control.
• Staged releases: changes are deployed to a development environment and verified end-to-end before being promoted to production. Production releases go through Atlassian's Marketplace review process where applicable.

3. Access controls on our side

• Access to our Atlassian developer console, source repositories and Marketplace vendor account is restricted to named individuals of Prometheus Agency.
• These accounts use strong, unique credentials with two-factor authentication.
• We do not share developer or vendor credentials with any third party.

4. Vulnerability management

• We monitor security advisories for our dependency tree and the Forge platform (automated npm audit plus repository security alerts).
• Critical vulnerabilities affecting our apps are triaged immediately; our target is to ship a fix or mitigation within 7 days of a patch being available, and sooner when exploitation is likely.
• Lower-severity issues are fixed in the next scheduled release.
• Platform-level vulnerabilities are handled by Atlassian as part of Forge; our apps automatically benefit from Atlassian's platform patching.

5. Reporting a vulnerability (responsible disclosure)

We welcome reports from security researchers and customers. If you believe you have found a security issue in any of our apps:

• Email info@prometheus-agency.com with the subject line “SECURITY”, or use our support page.
• We will acknowledge your report within 2 business days and keep you informed while we investigate and remediate.
• We will not take legal action against good-faith security research that respects user data and does not disrupt the service.

6. Security incident response

If we become aware of a security incident affecting one of our apps:

• Contain: we assess impact and, if needed, disable the affected functionality or version immediately (Forge allows rapid rollback of app versions).
• Notify: we inform affected customers and Atlassian without undue delay, and in any case within 72 hours of confirming an incident that involves personal data, including what happened, what data was affected and what we are doing about it.
• Remediate and learn: we fix the root cause, verify the fix end-to-end, and record a post-incident review so the same failure cannot recur.

Note that because our apps store no customer data on vendor-side systems (see section 1), the realistic incident surface is limited to defects in app code; there is no vendor database whose breach could expose your content.

7. Data handling summary

• Access Lens stores nothing at all: it reads permission data live, renders it, and discards it. No cookies, no analytics, no tracking.
• Answers stores questions and answers as native Confluence content inside your own site — never on our systems. No cookies, no analytics, no tracking.
• CSV exports in both apps are generated locally in your browser and never pass through our systems.

8. Changes to this policy

If our security practices change, we will update this page and, where relevant, the apps' Marketplace listings before the change takes effect.

9. Contact

Security questions or reports: info@prometheus-agency.com (subject “SECURITY”) · Support page