security policy
Velum — PII Protection & DLP for Jira & Confluence · last updated 21 July 2026
vendor: su.engineering · security contact: security@su.engineering
summary
Velum is a security product, so the smallest attack surface we can ship is the one that never holds your data. The app runs entirely on Atlassian Forge. There is no vendor-operated server, database, or backup containing customer content. Detection, masking and remediation all execute inside your own Atlassian tenant. A compromise of su.engineering cannot expose your Jira or Confluence data, because we never hold it.
architecture
- Forge-native. No Forge Remote, no vendor backend, no third-party AI service in the request path.
- PII detection runs in-process: a regular-expression engine plus an on-device NER model executing under
onnxruntime-webinside the Forge function. - All persistence uses Forge app storage, scoped to your installation. App data is deleted when you uninstall.
- The only outbound request is a one-time download of the public, static AI model file from the Hugging Face CDN. It carries no customer content, and the two permitted hosts are declared in the app manifest — Forge blocks everything else at the platform level.
data protection
| Control | Implementation |
|---|---|
| Encryption at rest | Atlassian platform encryption on all Forge storage |
| Reversal keys | AES-256-GCM applied at the application layer, on top of platform encryption |
| Encryption in transit | TLS 1.2+ on all requests |
| Tenant isolation | Storage scoped per installation; no cross-tenant data path exists |
| Credentials | The app collects no Atlassian or third-party credentials and holds no secrets of its own; Forge issues its runtime authentication |
access control
Every backend method that reads or changes findings, audit records, reversal keys or configuration independently verifies that the caller holds Jira administrator permission before it executes. UI placement is not treated as an authorization boundary — the checks live in the backend, where they cannot be bypassed by calling the app directly.
De-anonymization — recovering an original value from a token — is the highest-risk operation in the product and is admin-gated and audit-logged without exception.
logging and audit
- The app maintains an in-tenant audit log of scans, masking, de-anonymization, configuration changes and administrative actions.
- Access to audit data is restricted to Jira administrators.
- Detected values, credentials and access tokens are never written to platform logs. This is enforced by review on every change.
secure development
- Source is held in a private repository; access requires multi-factor authentication.
- The app requests the narrowest scopes its functionality allows, and every new scope requires written justification before release.
- OWASP Top 10 is the reference for security review of application changes.
- Third-party dependencies are reviewed against published advisories before release. Velum's dependency tree is almost entirely Atlassian's own Forge SDK; where an advisory affects an upstream package we do not control, we track Atlassian's fix and ship it when available.
- Automated static analysis, dependency scanning and SBOM generation are being introduced into the build pipeline.
vulnerability disclosure
If you believe you have found a security vulnerability in Velum, report it to security@su.engineering. Please include enough detail to reproduce the issue.
We acknowledge reports within 2 business days and will keep you updated until the issue is resolved. Please give us reasonable time to ship a fix before public disclosure. We will not pursue legal action against researchers who report in good faith and avoid privacy violations, data destruction, or service disruption while testing.
Vulnerabilities may also be reported through Atlassian's Marketplace Security channel. Remediation follows the Atlassian Marketplace security bug fix policy timelines.
incident response
We maintain a documented incident response plan covering triage, severity classification, containment, remediation and notification. If an incident affects your data, we notify affected installations within 72 hours of confirming impact, using Atlassian's partner notification templates, and notify Atlassian in parallel. Where facts are still uncertain, we say so rather than issuing reassurance the evidence does not support.
compliance
Velum includes GDPR Article 17 (right to erasure) tooling: locate every occurrence of a data subject across Jira and Confluence, remediate, and export an audit-ready report. Because all data remains in your Atlassian instance, you remain the data controller and we act as processor without ever receiving the data.
su.engineering does not currently hold ISO 27001, SOC 2 or PCI certification. We would rather state that plainly than imply otherwise. The app's security posture rests on architecture — no vendor-side data — and on the controls described above, and is reviewed at least annually.
contact
Security: security@su.engineering
Support: support portal · support@su.engineering