Skip to main content

Security architecture

Exportelier's security model rests on a deliberate split into two apps, so that the app handling your issue data has no way to send it anywhere.

Main app: no fetch, no webtriggers​

The main app declares no external fetch and no webtriggers in its Forge manifest. PDFs render entirely on Forge, with no headless browser and no third-party servers. This is enforced by Atlassian's platform — it is an architecture guarantee, not a policy promise.

Two-app architecture diagram A diagram: the main app (no egress, renders on Forge) alongside the Automation app (all egress, isolated).

Automation app: isolated egress​

Everything that needs to send data outward — email, Slack incoming webhooks, Microsoft Teams Workflows and API — lives in the separate Exportelier Automation app. It carries all outbound traffic, with SSRF protection and provider-specific secret URLs.

Why split them​

If your policy forbids outbound traffic, you install only the main app and have a hard guarantee that nothing leaves Atlassian. Teams that need delivery add the Automation app knowingly.

See also Data residency and the Procurement & vendor security page.