Creativas is SOC 2 Type II compliant since December 2024. For more information, please visit our Trust Center

Overview

Smart Courses for Confluence app (the “App”) is part of the Bug Bounty Program, which helps detect security vulnerabilities faster and increases the overall security level for our customers.

Secure development

We follow the best practices and frameworks to ensure the highest level of security in our software:

  • Regular security training for developers to learn about common vulnerabilities and threats
  • Code review for security vulnerabilities
  • Regular updates of the dependencies
  • Software Composition Analysis (SCA) to detect vulnerabilities in our codebase

Employee Access to Customer Data

The App’s team does not have access to user data. In cases where they have to access the user data in order to perform support services or respond to an incident, we will ask for your consent. Our employees connect to the infrastructure via secure communication channels with several levels of protection.

Working on a support issue, we only access the minimum data needed to resolve the issue.

Product Security

The App uses Atlassian Forge, which relies on HTTPS and  OAuth 2.0 Authentication to secure communication between the App, the Atlassian product, and the user. Smart Courses doesn't work with or store any passwords or credentials, as users use the App only in conjunction with Confluence.

Please learn more about Atlassian Forge security.

Permissions

The maximum set of actions Smart Courses may perform is expressed in the scopes in the App descriptor and is presented to the administrator during installation. This security level is enforced by Atlassian Forge and cannot be bypassed by app implementations.

Here is the list of all used scopes:

  • read:confluence-content.all - Read the content body and restrictions
  • read:confluence-content.summary - Get webhooks
  • read:space:confluence - Get space configuration
  • write:space:confluence - Update space configuration
  • read:page:confluence - Get page information
  • write:page:confluence - Update page
  • read:attachment:confluence - Get attachment information
  • read:content-details:confluence - Get the user information
  • write:confluence-file - Create and edit attachments
  • write:custom-content:confluence - Create custom content 
  • write:confluence-content - Add labels and course restrictions 
  • read:custom-content:confluence - Get custom content 
  • delete:custom-content:confluence - Delete custom content 
  • read:label:confluence - Get labels
  • search:confluence - Search custom content 
  • read:confluence-user - Get the user information
  • storage:app - Store migration status and API token
  • read:user.property:confluence - Get the user information 
  • write:user.property:confluence - Update the user information 
  • delete:attachment:confluence - Delete attachments
  • read:app-user-token - Authenticate user actions
  • read:app-system-token - Authenticate app actions
  • read:confluence-groups - Get group members

  • read:email-address:confluence - Get email addresses to send notifications

  • read:comment:confluence - Get comment

  • write:comment:confluence - Update comment

  • delete:comment:confluence - Delete comment

  • read:user:confluence - Get users' information

Learn more in the following Atlassian documentation:

Network and Application Security

The App hosts its infrastructure and data in Amazon Web Services (AWS) in Frankfurt.

Backups and Monitoring

Smart Courses uses automation to backup all data stores that contain customer data. All our backups are encrypted.

Encryption

All data sent to or from Smart Courses systems is encrypted in transit over public networks using TLS 1.2+ to protect it from unauthorized disclosure or modification. We use only AWS-managed network components and policies enforcing TLS with strong ciphers and key lengths where supported by the browser.

Pentests and Vulnerability Scanning

Smart Courses uses third-party security tools to continuously scan for vulnerabilities and participate in the Atlassian Marketplace Bug Bounty Program for crowdsourcing vulnerability discovery.

Incident Response

Smart Courses implements an Incident Response Policy for handling security events which includes escalation procedures, rapid mitigation, and post-mortem. All employees are informed of our policies.

Reporting An Issue

We appreciate your input and feedback on our security, as well as responsible disclosure.

In case you've identified a security concern, please create a request in our support system. We'll work with you to ensure we understand and address the issue promptly.