Data Processing Agreement — Space Access

Last updated: 14 August 2026

This Data Processing Agreement ("DPA") governs the processing of personal data by the Space Access app for Confluence Cloud ("the app"), supplied by Kauê Natan Gonçalves Bidim, trading as Saoirse Software, in Ireland ("we", "us", "the Processor"). It forms part of the Terms of Service and should be read with the Privacy Policy.

How this DPA is entered into. This DPA applies automatically between us and your organisation from the moment the app is installed on your Confluence site, for as long as it remains installed. No signature is required for it to be binding. If your legal team needs a countersigned copy, or needs it attached to your own paper, email support@saoirsesoftware.com and we will sign and return it.

1. Roles

Your organisation — the Atlassian customer that installed the app — is the data controller. It decides who has access to which Confluence space, who reviews that access, and which changes are made. We are the data processor: we process data only to make the app work, and only on your instructions.

Your instructions are given through the app itself and through this DPA. We will not process data from your Confluence site for any other purpose — not for our own analytics, not for product research, not for marketing, and not for training any machine-learning or AI model. We do not sell personal data and receive no payment from anyone for access to it.

2. What is processed

This app was designed to hold as little as possible, and the table below is the whole of it. The distinction that matters: what the app reads live and forgets, and what it writes down.

Subject matter	Reviewing who can reach each Confluence space, exporting that review, and removing a person or group from several spaces at once.
Duration	For as long as the app is installed on your Confluence site.
Nature and purpose	Reading space permissions and displaying them; producing a spreadsheet of what is on screen; removing space permissions when an administrator confirms it; and keeping a log of the changes the app itself made.
Categories of data subject	People who hold a user account on your Confluence site and appear in the permissions of a space, and the administrators who use the app.
Read live, never stored	Display names of people and groups, fetched from Confluence at the moment a screen is drawn so the tables and the spreadsheet show names instead of codes. They are held in the browser for that screen only and are gone when the page closes. Space names, keys and status; the space permission entries themselves; and the space role names your Confluence uses ("Administrator", "Collaborator"…). Whether the caller can review space permissions, and which groups the caller belongs to — both asked of Confluence at the moment they are needed, to decide what the caller may do.
Written down (the only stored data)	A change history record, written only after an administrator confirms a bulk removal. Each record contains: the date and time; the Atlassian account ID or group ID whose access was removed, and the account ID of the administrator who ran the change; the space IDs that changed, and the space IDs that did not; a fixed reason code from a closed list (for example "last admin") when something was refused. The newest 200 records are kept; older ones are deleted automatically.
Never stored	No names — not of people, not of groups, and not of spaces. No email addresses, phone numbers or profile pictures. No page, blog, comment or attachment content. No passwords, tokens or payment details. No analytics, no tracking, no cookies of ours. Why space names are excluded on purpose: a personal space is named after its owner, so storing space names would have meant storing people's names without meaning to.
Special category data	The app has no field for health, ethnicity, beliefs or any other special category of data, and no free-text field of any kind. Nothing a person types travels into a stored record.

Technical error lines. When a call to Confluence fails, the app writes a short diagnostic line into Atlassian's own app logging for your site (for example "the group name lookup was refused (401)"). Account IDs, group IDs and email addresses are stripped out of those lines before anything is written, and the line is truncated. Those logs are held and deleted by Atlassian, not by us.

3. Where the data is held, and international transfers

Everything the app stores is held in Atlassian Forge storage, within the Atlassian cloud region of your own Confluence site. The app is built on Atlassian's Forge platform and declares no external network access in its manifest, which means the platform itself prevents the app from sending data to any address outside Atlassian. There is no server of ours anywhere in the path.

We carry out no international transfer of your data, because we never receive it. Any transfer that occurs is Atlassian's own, under Atlassian's terms with you and Atlassian's own transfer safeguards.

4. Sub-processors

We use one sub-processor for the data in the app:

Sub-processor	What it does	Where
Atlassian Pty Ltd (and its group companies)	Provides the Forge platform, the compute that runs the app and the storage that holds the change history described in section 2.	The Atlassian cloud region of your own Confluence site.

Atlassian is already your own data processor for Confluence, under the agreement you hold directly with Atlassian. We add no other sub-processor: no analytics provider, no error-reporting service, no hosting provider of ours, no AI service.

One thing to be aware of separately: if you or your staff email our support address, that correspondence sits in a Google-hosted mailbox, which processes it as a sub-processor of that correspondence only. It never contains data pulled out of your Confluence site unless you choose to put it in the email yourself.

If we ever intend to add or replace a sub-processor, we will publish the change on this page and update the date at the top at least 30 days before it takes effect. If you object on reasonable data-protection grounds within that period, you may uninstall the app and end this DPA; billing stops under Atlassian's rules.

5. Security measures

The app's security rests mainly on a deliberate design decision: it holds almost nothing and has nowhere to send anything. Concretely:

No infrastructure of ours. No servers, no database, no backups, no logs outside Atlassian, no administration console. There is no system of ours for an attacker to breach, and no credential of ours that would unlock your data.
No egress. The app declares no external network access. This is enforced by the Forge platform, not merely promised by us.
Authentication and authorisation are Confluence's. The app has no separate login and no password to steal. Every call it makes to Confluence is made as the person using it, never with borrowed powers — so Confluence itself refuses anything that person could not do in its own screens.
Least privilege. The app asks only for: its own storage, reading spaces, reading and writing space permissions, reading users, reading groups, and reading the site configuration (which is how it knows your Confluence plan, so it can warn you before a change that the plan would refuse). It does not request permission to read pages, blogs, comments or attachments — so it could not read them even if a future version tried.
Nothing changes without a preview and a confirmation. A bulk removal is shown first, re-read from Confluence at that moment, and only proceeds when an administrator confirms it.
Two removals the app refuses outright, on the server: removing the last administrator of a space, and locking the person running the change out of a space — including through a group they belong to. These run in server-side code, not merely in the interface, so a crafted request is rejected rather than made hard to click.
Deleting the log is restricted. Only someone who can review space permissions on your site can delete change-history records, and the server verifies that on every attempt. A person who cannot see permissions cannot erase the trace of a change.
Encryption. Data is encrypted in transit and at rest by Atlassian, as part of the Forge platform.
No developer access. We cannot read your data. There is no dashboard, no export route and no support back door that would let us. To help with a support question we rely on what you tell us, or on a screenshot you choose to send.
Confidentiality. Only one person — the sole trader named at the top of this page — develops and supports the app, and is bound by a duty of confidentiality in respect of anything learned about your organisation. There are no employees or contractors with access.
Tested behaviour. The rules that decide what may be removed, what is refused, what may be written to the log and what may be deleted from it are covered by an automated test suite that is run before every release.

Being straight about the limits: we hold no security certification — no ISO 27001, no SOC 2 — and we do not claim one. We do not run a bug bounty programme or commission penetration tests. What we offer instead is a much smaller attack surface than an app with its own servers, and the platform-level assurances Atlassian publishes for Forge.

6. Who can see what

Space permissions are shown to whoever opens the app, exactly as far as Confluence allows that person to see them. The app asks Confluence as that person: someone who cannot review a space's permissions sees nothing for that space.
The change history is visible to people who can open the app, and shows which access was removed from whom, by whom and where. It contains no reason written by a human — only the fixed reason codes described in section 2.
Deleting history records is limited to those who can review space permissions, as described in section 5.
We cannot see any of it.

7. Helping you meet your own obligations

Because the app is designed so that we hold no copy of your data, everything you need you can do yourself, immediately, inside the app. We will assist where you cannot.

Access and portability. The whole permission picture is on one screen and exports to a spreadsheet with one button, including names written out.
Rectification. Space permissions are corrected in Confluence itself; the app reads them live, so a correction there is reflected here immediately. The change history is a record of what happened and is not edited — where it must not stand, it is deleted, see below.
Erasure. Someone who can review space permissions can delete any individual history record, or the entire history, from the screen at any time. It takes effect immediately and there is no copy to restore from. Because the change history is the only thing the app stores, deleting it is complete erasure of everything the app holds. Deleting the app's data for your whole site is also done by uninstalling it, see section 8.
Restriction and objection. Uninstalling the app stops all processing at once; nothing of the app keeps running in the background.
Requests we receive directly. If a data subject contacts us instead of you, we will not answer on your behalf. We will tell them to contact their employer and, unless it is unlawful to do so, let you know without undue delay.
Impact assessments and consultations. On written request we will provide the information about the app that you reasonably need for a data protection impact assessment or a consultation with your supervisory authority.

8. Deletion at the end

When a Confluence administrator uninstalls the app, Atlassian deletes the app's storage for your site as part of its normal uninstall process. We keep no copy anywhere, because we never had one, so there is nothing further for us to return or destroy. If you require written confirmation of deletion, ask and we will provide it.

Permissions that were already removed through the app stay removed — uninstalling the app does not put access back. That is a change to your Confluence site, not data of ours.

9. Personal data breach

If we become aware of a personal data breach affecting personal data processed through the app, we will notify you without undue delay and in any event within 72 hours of becoming aware. The notice will describe what we know, the likely consequences and what is being done. We will assist you with your own notification duties under Articles 33 and 34 GDPR.

Two honest points about how that notice reaches you. First, the app deliberately stores no email addresses, so we will contact you using the technical contact Atlassian provides to us for your licence, and any address you have written to us from. If you want breach notices to reach a specific mailbox — a security team, a DPO — email that address to us and we will record it against your licence. Second, because the data lives in Atlassian's infrastructure and not ours, a breach of the underlying platform would be detected and notified by Atlassian under your agreement with them, and we would very likely learn of it at the same time you do.

10. Information and audit

On reasonable written request, and no more than once a year unless a breach or a supervisory authority requires otherwise, we will provide the information you need to verify our compliance with this DPA — what the app stores, which permissions it holds, and how the access rules work. Being straight again: as a sole trader we cannot host an on-site audit, and there is no infrastructure of ours to inspect. For the platform layer, Atlassian's own published compliance material is the applicable evidence.

11. Liability, term and law

This DPA takes effect on installation and ends when the app is uninstalled and any remaining data is deleted, whichever is later. Where its terms conflict with the Terms of Service on a matter of data protection, this DPA prevails. The liability limits in the Terms of Service apply to this DPA, except where the GDPR does not permit them to. This DPA is governed by the laws of Ireland.

12. Changes

If this DPA changes, the date at the top changes and the new version is published here. For changes that reduce your protections, or that add or replace a sub-processor, we give 30 days' notice on this page before they take effect.

13. Contact

Space Access is supplied by Kauê Natan Gonçalves Bidim, trading as Saoirse Software, in Ireland. Data protection questions, requests under this DPA and security reports all go to support@saoirsesoftware.com. Emails reach the person who writes the code.

← Back to Space Access