Security & data

This is the operational view for admins: what WikiFix touches in your Confluence, what it keeps, and what it doesn’t. The formal claims — jurisdiction, encryption, subprocessors, what we don’t have yet — live on the security page; this page summarizes and links rather than restates.

Pages in the spaces a scan scopes, fetched read-only through Atlassian’s Forge platform at scan time. Scans read with the app’s own access — the access your Confluence admin grants WikiFix at install — not with the personal permissions of whoever started them. Two things bound what a scan can reach: the spaces it was scoped to (a scan never fetches outside them), and the app’s authorization itself, which admins grant at install and can restrict further with Atlassian’s app access controls. The scope list is public in the Forge manifest on the Marketplace listing.

Processed transiently: the full text of scanned pages. Pages are fetched, chunked, and analyzed during a scan run; WikiFix keeps no full copy of your wiki.

Stored: the working set WikiFix needs to do its job —

• a derived index (chunk embeddings) used to spot related passages,
• the short excerpts behind each finding — including the titles of the pages a finding involves — so a finding stays readable after the page changes,
• scan and run history — kept in WikiFix’s own database and shown in the app, not written into your Confluence — and the credit ledger.

There’s one place a whole page body is kept, and it’s so you can undo something: when you merge duplicate pages, the page you didn’t keep has its previous body stored, because that’s what a revert puts back. Nothing else stores a full body.

All of it is stored and processed in AWS Frankfurt (eu-central-1). Your content is never used to train AI models; see the security page for the contractual detail.

The AI step runs on AWS Bedrock in the EU by default. Some steps may instead run on Mistral’s EU endpoint in France — also EU-resident. The one path that leaves that setup is yours to choose: on a paid Advanced plan you can add your own Anthropic API key, and the AI work then goes to Anthropic’s API under your account and your agreement with Anthropic — both the scan and the rewrite that authors a fix. Bring-your-own-key isn’t available on Standard, or during Atlassian’s 30-day evaluation; see Editions & plans and Credits & capacity.

One more thing worth knowing: to monitor the quality of the AI’s findings, the text sent to the model and its reply are recorded in Langfuse, our AI-observability sub-processor. That text includes the page content under review, so unlike everything else on this page it is genuinely content-bearing. Langfuse is pinned to an EU instance. The full list of who processes what is on the sub-processors page, and changes to it are published in advance to a feed you can follow.

Nothing, until you click:

• Apply writes the chosen fix to the disagreeing pages — as the approving user, visible in page history, and revertable in one click. For a departed-owner finding, Apply reassigns the page’s owner instead of editing its text; that one isn’t revertable, because handing the page back to someone who has left doesn’t mean anything. The card tells you so before you click.
• Ask owner posts a comment on the page, anchored to the passage in question, and hands the decision over — the finding moves to your Escalated tab until someone settles it.

WikiFix creates no pages in your Confluence — scan results live in WikiFix, not in your wiki. Merging duplicate pages doesn’t delete or archive anything either: the pages you didn’t keep stay live, their content replaced by a short notice linking to the one you kept, so existing links to them keep working.

Comments WikiFix posted stay in your Confluence — they’re ordinary comments, and you can delete them like any comment. Server-side, WikiFix marks the installation removed and holds your data for 30 days, so a re-install picks up exactly where you left off. After 30 days a daily job deletes it permanently, whether or not you ask. Want it gone sooner? Email security@wikifix.ai.

WikiFix sends product-analytics events to PostHog and error reports to Sentry, both on their EU instances, so we can see which parts of the product work and which break. Every event passes an allow-list in code before it leaves: a property that isn’t on the list for that event is dropped, and page titles, excerpts, space names, and Atlassian account IDs are blocked outright. Events carry counts, durations, outcomes, and our own internal IDs.

Two deliberate exceptions, because pretending otherwise would be dishonest:

• your Atlassian site host (for example acme.atlassian.net), so we can tell tenants apart,
• whatever you type into the WikiFix search box, because what people search for and what returns nothing is how we learn the product is failing them.

There’s no per-tenant opt-out today. If you need one, email support@wikifix.ai — knowing someone wants it is how it gets built.

Encryption in transit and at rest, tenant isolation, subprocessor list, what we don’t have yet (and when we will) — all on the security page. The short privacy policy covers the same ground from the data-subject side. Our Data Processing Agreement is published in full and applies when you accept the Terms, so there’s nothing to request or sign. Anything unclear: security@wikifix.ai.