ChartsmithSecurity
Effective 03/11/2026. This page is for security reviewers evaluating Chartsmith - Charts for Confluence with Jira Data, provided by Wattlebrooks Apps.
Runs on Atlassian
Chartsmith is built on Atlassian Forge and runs entirely on Atlassian's platform. It is eligible for the Runs on Atlassian program: the app has no outside connections and stores no data of its own.
Permissions
| Permission | Why |
|---|---|
read:jira-work | Run a chart's search and read the field values needed to group and count the matching work items, and list projects, filters and fields in the editor. |
read:jira-user | Show display names for user fields such as Assignee as chart labels. |
That is the complete list. No write permissions, no admin permissions, no app storage and no outside network access are requested.
Access control
- Every Jira read is made as the person viewing or editing the chart, after their one-time Allow access, so each person only sees work items they could already open in Jira. The app has no shared or app-level view of your data.
- All access uses Atlassian's own sign-in. The app never asks for API tokens or passwords and holds no credentials or secrets.
- Jira access is read-only. Chartsmith cannot create, edit, transition or delete anything in Jira.
- Chart settings are saved by Confluence with the page, and only when the person editing the page chooses Save chart.
Data handling
- No app storage, database or cache of Jira data.
- No outside servers, analytics, telemetry, AI or third-party services.
- Jira field values are displayed as plain text in the chart, never as page markup or scripts.
Compliance
Chartsmith inherits the security and compliance posture of Atlassian Forge, which holds SOC 2 Type II and ISO 27001/27017/27018 certifications. The app itself has no separate certification and does not handle payment data; billing is handled by Atlassian. The app is reviewed by Atlassian as part of Marketplace approval.
Changes
Each release is described in the What's new section of the Marketplace listing.
Reporting a problem
If you think you have found a security issue, email support@wattlebrooks.com or raise a request. We aim to reply within 2 business days.