ClaervoSecurity overview
The trust boundary, permissions and safeguards behind Claervo's personal-data and secret scanning for Atlassian Cloud.
Forge-only architecture
The application runs on Atlassian Forge with no external fetch permission, remote backend, external database, analytics endpoint or AI processor. Scanned text stays in Atlassian; the app is eligible for the Runs on Atlassian program.
Least-privilege scopes
Scopes are limited to reading Jira work items and Confluence content, writing the specific fields an administrator chooses to redact or label, and app storage: read:jira-work, write:jira-work, read:confluence-content.all, read:confluence-content.summary, read:confluence-space.summary, write:confluence-content, storage:app.
Safe write path
Every redaction or restriction is confirmed by an administrator, re-reads the target content immediately before editing and is skipped when the value is no longer present. Each change is written to an audit trail with actor, item, field, rule and count. Jira triggers ignore the app's own edits so scans cannot loop.
Rate limits and budgets
Scans run in small, checkpointed batches with a per-batch request budget; the daily scan is time-boxed and resumable. Idempotent requests retry with bounded backoff and honour Retry-After on HTTP 429 and transient server errors.
Data minimization
Findings carry a masked sample and a one-way hash, never the value. Allowlisted values are hashed before storage. Exports and reports contain masked samples only. Atlassian error bodies and scanned text are not logged in production.
Responsible disclosure
Report suspected vulnerabilities privately to support@claervo.com with impact, safe reproduction steps and affected scope. Reports are acknowledged within one business day.