VetoReview is an Atlassian Forge app that adds a safety-review panel and a Rovo agent to Jira and Confluence. It assesses planned actions by agents and automations — before they execute — and returns a verdict of ALLOW, HOLD-FOR-REVIEW, or VETO with human-readable reasons. This policy describes exactly what data the app processes and what it stores.
When a review is requested, the app reads the text of the relevant Jira issue or Confluence content (for example an issue description or a comment that requested an action) and scans it locally, inside the Forge runtime, against a fixed set of risk patterns (prompt-injection phrases, destructive-action requests, external data-sharing signals). Processing happens in memory at request time. The app does not execute the reviewed action itself.
The app stores an audit log of its own verdicts — the assessed action type, the verdict, the numeric risk score, the matched pattern identifiers, the reasons, and a timestamp — in Atlassian Forge app storage (storage:app) belonging to the site where the app is installed. This audit log stays inside the installing site's own Forge storage. It is not copied to any external server operated by the developer.
Audit-log records live in the installing site's Forge storage and are under the control of that site's administrators. Uninstalling the app removes the app's access; site administrators may also request deletion of stored audit records by contacting the developer at the address above, and the developer will action verified requests.
If this policy changes, the updated version will be published at this URL with a new "Last updated" date.
Questions about this policy or the app's data handling: binasalama12@gmail.com.