Security overview
The short answer is that diagram source lives in your Confluence site, not in ours. Diagrams are stored as page attachments and custom content inside your own tenant, under your own permissions.
Two things do leave: text diagram sources go to a rendering service to be drawn, and AI features send what you ask them to. Both can be turned off or moved in-house.
#When this matters
A security review before installing the app.
Answering a question about where diagram data lives.
Deciding whether to self-host the renderer.
#The detail
Thing | What happens |
|---|---|
Diagram source | Stored in your Confluence site as attachments and custom content. |
Permissions | Inherited from the page or space. There is no second permission model. |
Rendering | Text languages are drawn by a rendering service, or by your own Kroki server. |
Browser rendering | draw.io and Excalidraw never leave the browser at all. |
AI | Off by default to the extent you choose; entirely disableable site-wide. |
Platform | Built on Atlassian Forge, so it runs under Atlassian's app platform controls. |
#What a reviewer usually asks
Question | Answer | Detail |
|---|---|---|
Where is our data? | In your Confluence site | Where diagrams are stored |
What leaves the tenant? | Text diagram source, for rendering | What leaves your Confluence site |
Can we stop that? | Yes, self-host the renderer | Self-hosted diagram renderer |
What about AI? | Off with one switch | AI and your diagram data |
Who can see diagrams? | Whoever can see the page | Scopes and permissions |
#A few things that catch people out
The strongest configuration is a self-hosted renderer plus AI turned off. Then no diagram content reaches us.
Approving an egress domain is a decision with security consequences; read that page before adding one.
Anonymous readers get stored preview images rather than live renders, which is a privacy property as much as a technical one.
#Related
Ask us the awkward questions. They have answers.
