Security

Last updated: August 17, 2026

Sullins Labs builds apps for the Atlassian Marketplace. This page explains how they are built and where your data goes. It currently covers PIER, our Mermaid diagram rendering app for Confluence, and will be updated as further apps ship.

Zero outbound network connections

PIER makes no outbound network connections of any kind. The Mermaid library is bundled into the app rather than loaded from a content delivery network, and rendering happens entirely in your browser. There are no external servers, no third party services, no CDNs, and no analytics. Nothing you write leaves Atlassian's infrastructure.

Built on Forge

PIER is an Atlassian Forge app. It runs on Atlassian's own platform rather than on infrastructure we operate. Sullins Labs does not run any servers or databases, so there is no system of ours for your content to be copied to.

Permissions

PIER requests a single scope, storage:app. That scope grants access only to the app's own storage namespace. It does not grant access to page content, space data, user records, or any other product data.

The Confluence macro requires no scopes at all. Diagram source is held in the macro's own configuration, alongside the page it belongs to.

Where diagram source is stored

In Confluence, diagram source lives in the macro's configuration, so it travels with the page and is covered by your existing Confluence permissions, backups, and retention. Nothing is duplicated elsewhere.

Reporting a vulnerability

Send suspected vulnerabilities to security@sullinslabs.com. Please include enough detail to reproduce the issue. We will acknowledge your report and keep you updated as we investigate.

Please do not disclose publicly until we have had a reasonable opportunity to respond.

Related

The privacy policy covers what data is collected and how long it is kept. The PIER documentation covers installation and use.