Firnity Discord for Confluence connects Confluence Cloud and Discord through Atlassian Forge and a Firnity-operated remote service on Microsoft Azure. This page describes how the app authenticates requests, handles content and stores integration data.

Hosting & Infrastructure

  • The remote service, primary Azure SQL database and Azure monitoring resources are hosted in West Europe.
  • Production and development use separate application database servers and Key Vaults.
  • Azure SQL transparent data encryption protects database records at rest. Automated backups provide a seven-day point-in-time recovery window using locally redundant storage. Long-term SQL backup retention is disabled.
  • The database uses a public endpoint restricted by IP firewall rules for application and permitted release access.
  • Runtime secrets are held in Azure Key Vault. The production service uses an Azure managed identity for Key Vault access.
  • The production backend requires HTTPS with TLS 1.2 or later. SQL connections use encrypted transport, and the SQL server requires TLS 1.2 or later.

Authentication & Permissions

Requests from Atlassian Forge use signed Forge Invocation Tokens tied to the verified installation, site, operation and person where applicable. Confluence calls use the scoped app or user authorization appropriate to the requested operation.

Discord interactions are authenticated with Ed25519 cryptographic signatures. Account and server linking use OAuth 2.0 with protections against reused or intercepted authorization responses. Discord OAuth access and refresh tokens are discarded after verification; Atlassian user access and refresh tokens are not persisted.

Settings changes require the relevant Confluence administration permission. Sharing a page to Discord first checks the invoking person's access to the page.

Interactive Confluence actions, including sharing a page, creating a page, commenting and managing labels, use the current or linked person's Confluence authorization. Linked-user searches and page lists use that person's access.

Customers can configure Find page and Link previews to allow unlinked Discord members. In All users mode, an unlinked member's read uses the app's Confluence access; an active account link selects that person's authorization. Find page defaults to Connected users, and Link previews defaults to Disabled. Configured notifications and unattended summaries also use installation access.

Discord channel permissions and thread membership determine who can see a delivered card. Readers can see the content included in that card even when they cannot open its Confluence source. Opening the linked page still requires Confluence permission. Customers should choose destinations, card fields and sharing policies for their intended audience.

Data Handling & Residency

Confluence stores the pages, comments and attachments created through the app. The remote service processes page and comment content, names, search results, selected Discord messages, form input and attachments as workflows require. Configured Discord cards can contain selected page fields, names, excerpts, comments and links.

The Azure SQL database stores records such as:

  • Forge installation IDs, Confluence cloud IDs and site URLs, licensing information and short-lived Forge app-system tokens.
  • Atlassian-to-Discord account links, installation associations, link status and timestamps.
  • Discord server, channel, thread, message, user and role identifiers; destination display metadata; customer configuration, filters, schedules, command definitions and panel definitions.
  • Linked-discussion references, scheduled-event references, delivery timestamps, status, Discord message IDs and bounded failure details.
  • Data-lifecycle audit records and aggregated product-use counts.

Personal account links store Discord user IDs and Atlassian account IDs rather than a copy of the person's display name; current names are retrieved when needed. Customer-entered configuration text and provider display metadata remain separate stored data. Linked-discussion records do not store page titles. Selected additional private-thread members are stored by ID and user or role type, without saved names or labels.

Integration SQL stores search configuration and Confluence content IDs rather than a separate page index, search-result cache or rendered notification cards. Scheduled notifications retrieve current Confluence content when they are sent. Page creation drafts are held temporarily in service memory and expire for use after 30 minutes; selected attachments are processed in memory for upload to Confluence. The Discord bot examines messages it receives for Confluence links to support configured link previews.

The app does not offer a choice of region for its remote storage. Changing Confluence's data residency setting does not relocate that storage. Discord and the other providers identified on the Sub-Processors page have their own processing and retention arrangements.

Discord Integration

Customers choose connected servers, channels, threads, rules, summaries and panels. Private Discord command results can be posted to a channel through an explicit sharing action. Enabled link previews and saved automations can also post content to their configured destinations.

Creating a Confluence page from Discord or adding a comment sends the selected content to Confluence. Linked private threads can include the members selected in the command configuration. Discord bot permissions and thread membership control access on that platform.

Deleting a saved rule or disconnecting a server does not erase messages already delivered to Discord or content already created in Confluence. Those records follow the customer's controls and the receiving platform's retention settings.

Logging & Analytics

Azure Monitor provides backend diagnostics, and Sentry receives selected frontend exceptions. Records can include Confluence cloud IDs, Forge installation IDs and Atlassian account IDs, route and release information, bounded stack traces and failure details. Selected telemetry paths redact recognized credentials; outgoing HTTP telemetry sanitizes query strings, fragments, URL credentials and Discord webhook tokens. These controls do not guarantee that every diagnostic field is free of customer text. Discord OAuth start and callback routes are excluded from incoming HTTP telemetry.

The main Azure request, trace, exception and event tables retain records for 90 days. Configured alerts cover application and website availability, failure anomalies and overdue integration-data purge work.

PostHog receives limited usage events and minimized recordings of the Confluence Application interface for error diagnosis, reliability and workflow improvement. Information includes feature use and outcomes, selected options, browser/device and session information and sanitized interface URLs, which may include resource IDs. Random browser and session IDs are held in memory without persistent analytics cookies or analytics IDs stored in localStorage. Inputs and customer content are configured to be masked, and private media is blocked. Recordings exclude console output, network headers and bodies, performance recordings, canvas content and embedded content from other origins. They do not record the surrounding Confluence host or other applications.

Application analytics is enabled by default. Each signed-in person can turn it off in Account connection for that person on the current Confluence site. The choice does not require administrator permissions or a connected Discord account. Separate service, security and Sentry error records continue. Turning analytics off does not automatically delete historical provider records.

Recordings are available for up to 30 days under the configured recording window. Usage events are retained for the period needed to diagnose errors, maintain reliability and improve Application workflows, subject to applicable data-protection rights. This is separate from optional analytics on public marketing and Trust Center pages. See the Privacy Policy.

Request & Content Controls

The service validates structured inputs and signed Forge context at request boundaries. Supported workflows check Discord destination and bot permissions, limit attachment sizes and download sources, and escape text when constructing HTML, Discord messages and Confluence queries.

Privacy, Export & Deletion

The app has a tenant export and erasure process. Contact contact@firnity.com with the relevant site and request; identity and authority must be verified before customer data is returned or removed.

After we receive a verified Forge uninstall notice, access stops and stored Forge credentials are cleared. Settings and integration records are kept for 30 days, then deleted at the next daily cleanup. Reinstalling on the same Confluence site during this period resumes retained settings with fresh authorization and cancels deletion.

Backups follow their separate seven-day recovery window. Backup files can remain longer to support this recovery window. After reinstall, old installation details expire at the original 30-day deadline. After live deletion, a separate record used to reject old installation requests expires after one day and is removed at the next daily cleanup. Shared account links remain while another active installation needs them. Verified return or erasure requests follow the DPA; erasing an account link removes that link and its installation associations.

Operational diagnostics and Application analytics follow their separate retention rules. Uninstalling Application does not automatically delete analytics provider history. Content already sent to Confluence or Discord follows that platform's retention and the customer's controls.

The Privacy Policy and Data Processing Agreement describe the applicable data-protection terms.

Vulnerability Reporting

Report suspected vulnerabilities to contact@firnity.com, including the affected app surface, reproduction steps and potential impact. The Security Policy describes responsible reporting and testing limits. Do not access or change another customer's data.