Security review asks where document content and diagram source go

Updated
View as text
Open in Confluence
Open in ChatGPT Open in Claude

What you are seeing

Security review asks where document content and diagram source go.

#Why it happens

Documents are stored in Jira as .md attachments. To draw diagrams and show web images inside Jira, the app sends diagram source and image addresses to Capable's hosted services while a signed-in user views the document. Error reports go to Sentry.

#What to do

Share this page with your reviewer. There is currently no self-hosted renderer option and no way to keep diagram source inside your own network; if that blocks you, avoid diagram code blocks in sensitive documents.

#A few things that catch people out

  • Diagram source travels to Capable's rendering service inside the image address, so it is sent each time the diagram is displayed.

  • Logged-out viewers see nothing from the app, so no requests are made on their behalf.

Found it? Good.