Trust and security

Trust and security: what the apps can reach, and what we do not claim

Read from the app manifests on 31 October 2026. It adds to the Security Policy; it does not replace it.

Buyers ask three questions before they install an app that touches work items or policies: where does our data go, what can the app do with it, and what proof do you have. This page answers the first two from files anyone can check, and answers the third plainly, including the proofs we do not have.

• Where the data goes. Nowhere outside Atlassian. None of the three manifests declares an external network permission, a remote backend, a web trigger or a script or connect source. The records live in Forge hosted storage for your site. Checked from the manifests on 31 October 2026.
• What the apps can do. Exactly what the permissions below allow. Each is listed with a plain-language meaning and a link to Atlassian's definition.
• What we do not have. No SOC 2 report. No ISO 27001 certificate. No 21 CFR Part 11 or EU Annex 11 claim, and no validation package. Details at the end of this page.

Atlassian's Forge documentation says the manifest's external section "declares the external resources that your Forge UI app is allowed to access", and that it also covers "external website your Forge function is allowed to communicate with". The same page warns that using these capabilities "may make your app ineligible for Runs on Atlassian".

We read the manifests of all three apps at the production release tag (prod-3.0.0 for Approval Flow, prod-3.1.0 for Checklist Flow, prod-3.1.0 for Attestation Flow) with a script, trust_facts.py, and found, in each of them:

• no permissions.external section,
• no top-level remotes,
• no web trigger module,
• no script, connect or frame source in the content security settings.

Checklist Flow's manifest has one content setting: styles, which relaxes the style rule for inline styles inside the app's own panel. Its manifest comment says it does not widen script or connect rules, and the script above found no scripts or connect-src entry.

The apps do use Atlassian's own APIs: reading and writing Jira or Confluence data, as the scopes below say. Calls to Atlassian's APIs for your own site are not external egress.

The Runs on Atlassian program, in Atlassian's words, "Apps exclusively use Atlassian-hosted compute and storage." The badge is "automatically applied to eligible apps on the Atlassian Marketplace", so we do not apply for it and we do not put a badge of our own on this site; look at the Marketplace listing for what Atlassian shows. The same Atlassian page says the controls "do not prevent misuse of access granted to the app during installation or abuse of the app runtime". That is why the permission lists below matter as much as the egress list.

Atlassian's storage documentation says Forge hosted storage will "Keep data in the location of the host Atlassian app, so your app inherits data residency without extra configuration." The data residency page adds: "If an admin installs a Forge app using persistent Forge hosted storage on an Atlassian app that's pinned to a location, the app will automatically be located there too."

Our three apps keep their records in that storage. Some small pieces are written into Jira or Confluence themselves because that is what makes them searchable: a Jira issue property per work item, the value of an app-owned read-only field, a Confluence page property or a page comment. What is stored, field by field, is in each app's documentation, under "Your data, and what happens on uninstall": Approval Flow, Checklist Flow, Attestation Flow.

We run no servers and have no access to your data. This is stated in the same documentation and in the Security Policy.

Read from the manifest at prod-3.0.0 (commit c088774).

Read from the manifest at prod-3.1.0 (commit ef68249).

write:jira-work is the broadest of these. The manifest comment says it is used only for two calls made as the person who clicks, so Jira's own permissions apply; the app never edits an existing work item with it. That is our statement about our code, not something the scope itself guarantees.

Read from the manifest at prod-3.1.0 (commit 8f8b3b9).

write:page:confluence lets an app edit page bodies. Our documentation says the app uses it only to add a policy pack's starter text as the person who asks, and to write a page property; it never edits a page body as itself.

All three apps hold the scope report:personal-data and report the account IDs they store to Atlassian's personal data reporting API, so that closed accounts can be erased. Atlassian's page on this is User privacy for Forge apps. Each app also has an Erase a person function for a data-subject request, described in its documentation. Uninstalling an app deletes its stored records; export what you need to keep first. The Privacy Policy and the Data Processing Addendum cover the legal side.

• No SOC 2 report and no ISO 27001 certificate for Stanki Guild. Atlassian publishes how the Forge platform relates to those standards in Compliance with SOC 2 and ISO 27001; that describes Atlassian's platform, not our company. Where a buyer's procurement form asks for a vendor's own report, we have none to give.
• No Part 11 or Annex 11 claim. Approval Flow and Attestation Flow have electronic-signature controls (name, time, meaning, a hash of what was signed, a signature PIN). Whether those satisfy 21 CFR Part 11 or EU GMP Annex 11 for your process is for you and your auditor to decide, and we supply no validation package.
• No promise that an app makes you compliant with any standard or regulation. The apps produce records.
• No claim about a Marketplace badge. Runs on Atlassian is applied by Atlassian, Cloud Fortified and similar programs are applied for. Check the listing.
• Manifest changes. A new version can add a permission. Atlassian shows the administrator what changed and asks for consent. This page is dated and names the release tags it was read from; it is not a promise about future versions.

• A penetration test report, a SOC 2 Type II report or an ISO 27001 certificate of our own: not available.
• Whether the Marketplace listing currently shows a given badge: look at the listing itself.
• A security questionnaire in your own format: send it to security@stankiguild.com and we will fill it in.

To report a vulnerability, follow the Security Policy (security@stankiguild.com).

• Security Policy: how to report a vulnerability, and the policy in full
• Privacy Policy
• Data Processing Addendum
• Support