Trust

Security Statement

GxP Seal runs entirely on Atlassian Forge — no remote backend, no third-party services, no external data egress. Its security posture is (a) inheriting Atlassian’s platform controls and (b) a small, auditable set of app-level controls.

GxP Seal, LLC (Delaware, USA · file no. 7890123) · Effective 22 September 2026 · [email protected]

1Architecture & platform

• The app runs on Atlassian Forge and stores all data in Atlassian-hosted storage. We operate no servers, databases or endpoints of our own.
• With no infrastructure of ours in the path, the app inherits Atlassian Cloud’s security controls — encryption in transit and at rest, tenant isolation, and Atlassian’s own compliance programs.

2Data residency & egress

• No external egress. The app makes no outbound calls to any third party and sends no email. Notifications are delivered by Atlassian’s own mechanisms (a Confluence comment mention), never by us.
• Residency inherited. Storage is Atlassian-hosted, so signature data follows your Atlassian site’s data-residency configuration automatically.

3How we handle sensitive data

• Signing credentials are stored only as a salted scrypt hash, verified in constant time, and never written to logs or error messages. A separate recovery factor governs reset, so an administrator cannot unilaterally set a user’s signing credential (anti-collusion).
• Page content is not stored. At signing time the app computes a SHA-256 hash of the page body and stores only that hash.
• Failed-attempt lockout rate-limits credential verification to resist guessing.

4Integrity & tamper-evidence

• Every signature is linked into an append-only SHA-256 hash chain: reordering, editing, inserting or deleting any entry breaks the chain at a detectable point. We claim tamper-evident, not tamper-proof.
• Certificates and retention exports are self-verifying — a third party can confirm them without our app using the published method at gxpseal.com/verify.
• The approval-flow notification log is itself hash-chained and append-only.

5Access control & authorization

• Two-component signing: the authenticated Atlassian account identity plus the app signing credential, both verified on every signing.
• Administrative operations are gated by a fail-closed Confluence-administrator check — a caller must belong to a Confluence admin group; any error denies.
• Per-meaning authorization can restrict which Confluence groups may apply a given meaning. Signer identity is always bound to the authenticated context, never a client-supplied value.

6Least-privilege permissions

The app requests only the Confluence scopes it needs:

• storage:appthe app’s own Forge storage (records, hashed credential)
• read:page:confluenceread the page body/version at signing (for the content hash) and render the manifestation
• read:space:confluenceresolve a page’s space
• read:confluence-usercapture the signer’s name/email at signing
• read:confluence-groupsverify admin/authority group membership
• write:comment:confluencepost the in-Confluence notification comment (never edits page bodies)

7Availability & continuity

Availability, backup and disaster recovery are provided by the Atlassian Forge platform; the app adds no separate infrastructure to fail.

8Sub-processors

None beyond Atlassian. There are no analytics, logging, email or storage third parties in the app’s data path.

9Vulnerability disclosure

Report suspected vulnerabilities to [email protected]. We aim to acknowledge reports within two (2) business days and to work with you on coordinated disclosure. Please do not publicly disclose before we have had a reasonable opportunity to remediate.

10Compliance & shared responsibility

• The app’s 21 CFR Part 11 design (two-component signatures, permitted sequencing, authority checks, audit trail) has been reviewed and signed off by qualified regulatory counsel; the position paper and continuing-obligations record are available for your validation pack.
• Compliance is shared: the app provides technical controls and evidence; your organisation remains responsible for surrounding SOPs, user training, access provisioning, periodic credential revision, and validation.

11Contact

[email protected] · GxP Seal, LLC (Delaware, USA)