Security
Page Sign-off for Confluence, by TECHGL LLC. Updated September 22, 2026.
Where the app runs
Page Sign-off is a Forge app. It runs on Atlassian's infrastructure, inside your Atlassian site. There is no server operated by TECHGL LLC, no database outside Atlassian, and no external hostname the app is permitted to call. The app declares no egress in its manifest, so a call to an outside service would fail rather than silently succeed.
What is stored
One record per sign-off, held in Forge hosted storage: the page and space ids, the Atlassian account ids of the requester and approvers, each decision with its comment and timestamp, and the page version numbers at request and approval time. Page body content is never read into storage. Uninstalling the app deletes the records.
Because all of it sits in Forge hosted storage, Atlassian pins the data to the same region as your Confluence site.
Permissions
The app requests the smallest set of scopes that lets it work, and each one maps to a single function.
- Read page content, used only to read a page's current version number
- Write comments, used only to notify named approvers and the requester
- Read content permissions, used to confirm an approver can read the page before they are assigned
- Read space details, used to render the space sign-off log
- App storage, used to hold the sign-off records
Authorisation
Every decision is attributed to the Atlassian account of the person who made it, taken from the platform's own request context rather than anything the browser sends. A request cannot be approved by someone who was not named as an approver, a requester cannot approve their own request, and a second decision from the same approver is rejected.
Reporting a vulnerability
Email admin@techgldev.com with the subject line "security". Please include the steps to reproduce and the site you observed it on. We aim to acknowledge within two business days, and we will tell you what we found and when it was fixed. Please do not test against a site you do not own.
What we do not claim
TECHGL LLC is a small company. We hold no SOC 2 or ISO 27001 certification, we do not run a bug bounty, and we have not commissioned an external penetration test. We would rather say so than imply otherwise. The app's security posture rests on running entirely within Atlassian's platform with a minimal permission set and no external data flow.