Data flow, scopes, permissions, storage, and retention

Data flow

Content flows from the customer's Confluence site through Atlassian Forge to the selected GitHub repository. Operational metadata is stored in tenant-isolated Forge storage. There is no write path back to Confluence and no vendor-side content store.

Confluence Cloud --read--> Atlassian Forge --write managed output--> selected GitHub repository
                              |
                              +--store bounded configuration and operational metadata--> Forge KVS

The product direction is always Confluence to GitHub.

Exact Forge scopes

The production manifest declares exactly these scopes:

Scope Read-only or platform purpose
read:confluence-user Check the current user's Confluence administration permission before administrator operations.
read:space:confluence List and validate spaces and read space-level source and app-access evidence.
read:page:confluence Complete the page inventory and fetch ADF page bodies for conversion.
read:attachment:confluence List attachment metadata and download only referenced, eligible images.
storage:app Store tenant-isolated mapping, run, authorization-audit, entitlement-diagnostic, and recovery-plan metadata. This is a Forge platform scope, not a Confluence content-write scope.

There is no Confluence write scope, write endpoint, or product write path.

GitHub permissions and egress

The GitHub App uses repository Contents: read and write and baseline Metadata: read. The configured backend fetch destinations are exactly:

  • https://github.com for Forge-managed GitHub authorization; and
  • https://api.github.com for GitHub App, repository, and Git database operations.

There is no wildcard or browser-side GitHub egress. See GitHub authorization and branch behavior for the operation-level explanation.

Stored customer-visible categories

Forge storage may retain bounded categories such as:

  • mapping configuration: Confluence space identity; GitHub installation/repository identity; branch; base path; schedule flag; mapping status; and configured limits;
  • non-secret authorization health, last-check timestamps, and a bounded mapping-scoped authorization audit;
  • page and attachment identifiers and metadata, source versions, generated paths, hashes, and Git object identifiers;
  • run identity, state, phase, counters, timestamps, stable diagnostic codes, and sanitized technical identifiers;
  • content-free execution and publication-recovery state, retry deadlines, and immutable rebuild or manifest-repair plan metadata; and
  • the last verified successful commit and ownership-manifest provenance.

The repository ownership manifest is stored in the configured GitHub branch at <base>/.conf2git/manifest.json. It defines managed output only after its identity and app-published provenance validate.

Data that Conf2Git does not persist or return

Conf2Git does not persist, enqueue, return, diagnose, or log:

  • GitHub App private keys or OAuth client secrets;
  • App JWTs, user tokens, installation tokens, or authorization headers;
  • raw GitHub or Confluence responses or headers;
  • raw Marketplace licence context, payloads, billing identifiers, entitlement identifiers, or licence responses;
  • Confluence page bodies or ADF documents in Forge storage;
  • generated Markdown bodies in Forge storage;
  • attachment or image bytes in Forge storage; or
  • stack traces or arbitrary provider error text in customer diagnostics.

Page bodies and image bytes are processed transiently and the intended generated bytes are written to the selected GitHub repository. No vendor-controlled remote backend processes or stores page content in public v1.

Tenant and administrator boundary

Forge storage is isolated by app installation. Conf2Git also validates the current site, mapping, run, repository, plan, and other bounded identities before reads or mutations. Sensitive configuration and lifecycle methods require a current server-side Confluence administrator check; UI visibility alone is not authority.

Run-detail page titles and source URLs are redacted because site-administrator access does not prove current visibility of each page.

Marketplace entitlement

An active paid licence or active standard evaluation allows synchronization. Expired, inactive, missing, malformed, contradictory, or unavailable evidence fails closed. Development and staging have no application bypass.

Entitlement is checked from current server evidence at synchronization boundaries. It is not reconstructed from browser state, a previous run, a background request, or stored status. Entitlement loss pauses new work and prevents unsafe publication; it does not delete or rewrite mappings, GitHub bindings, generated files, ownership state, last-known-good success, or history.

Manual and scheduled synchronization

Sync now and an eligible daily opportunity use the same bounded reconciliation behavior. The daily schedule is a Forge-managed day interval and does not promise an exact local time. A mapping marked Schedule disabled, paused, already running, or needing attention is not automatically dispatched. Manual work also requires a ready mapping and current entitlement.

Retention and deletion

  • Aggregate run history is bounded to the latest 30 runs per mapping.
  • Page and asset outcome detail is available only while it remains within both the latest-five-run window and the seven-day retention boundary. Aggregate history may remain after detail expires.
  • Authorization audit retains at most 20 newest-first events for 90 days.
  • Background execution and publication-recovery evidence are bounded and normally retained for seven days; immutable rebuild/repair plan material is retained for at most eight days, with a 30-minute confirmation lifetime.
  • Removing a mapping deletes the mapping configuration, stored non-secret GitHub binding association, scheduled acceptance, and referenced authorization-audit records through the supported removal boundary. It does not uninstall the GitHub App or delete repository files.
  • Uninstalling the Confluence app is managed in Atlassian Administration. Do not assume uninstall removes generated GitHub content or the GitHub App installation.

See Recovery and lifecycle operations before removal or uninstall.