Security & compliance
Exportelier was designed for regulated teams from day one — not retrofitted for them.
Your data never leaves Atlassian
The main app declares no external fetch and no webtriggers. PDFs render entirely on Forge, with no headless browser and no third-party servers. This is an architecture guarantee enforced by the Forge manifest, not a policy promise.
Audit-ready out of the box
An append-only audit log records every export and admin event — pseudonymous IDs, metadata only — with filters and CSV/JSON export for your compliance team.
Digital PDF signatures
Cryptographically sign exports so Acrobat detects any tampering. The bundled certificate is included in every plan. Customer certificates remain available in Standard until Pro launches with V1.2; existing Standard use is grandfathered.
GDPR retention & auto-purge
Free can view and export the latest 30 days of audit history; this Free window does not delete older entries. Standard and Pro can configure physical retention from 30 to 730 days, and a daily automatic purge applies that setting independently of edition. After an upgrade, older entries may become visible again if the purge has not already removed them. Generated documents are streamed to you and deleted — nothing is stored long-term.
Permission-first, always
Every operation starts with a permission check: exports run as you, seeing only issues you can browse. Template management is admin-only.
Egress isolated by design
Email, Slack incoming webhooks, Microsoft Teams Workflows and the API live in a separate app — Exportelier Automation — that you only install if you need them. It carries all outbound traffic, with SSRF protection and provider-specific secret URLs, so the main app can keep its "data never leaves Atlassian" guarantee.
The separation between the main app (no egress) and the optional automation app (all egress, isolated) is deliberate. If your policy forbids any outbound traffic, simply don't install the automation app.