nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

What makes an App feel safe?

unknown

I'd love to know your thoughts on which of the following security and trust signals you would personally look for when deciding to install a Marketplace App?

1 - Cloud Fortified Status

2 - Positive User Reviews

3 - Atlassian Marketplace Level (Silver, Gold Platinum)

4 - Other trust indicators (please comment)

Accepted answers

Lucas_DevSamurai_

Hi @[deleted], it's great to see such an interesting question.

Like you mentioned, the first thing I will look for is the Cloud fortified status of a specific app. This proves that I can rely on the vendor who made the app to keep my data secured. And besides, it also relates to other trust indicators like SOC 2 or Penetration Test results. I personally believe these indicators can greatly affect my decision when installing an app.

Although User reviews plays a big role, I will pay more attention to the most recent reviews rather than the overall positive ones 😉

Stavros_Rougas_EasyApps

@[deleted] built in Forge and supports data residency.

Forge is the new cloud app development platform by Atlassian. We build all our apps in Forge. All data remains within your Confluence instance. By default Forge supports data residency.

About Forge:

"Secure by design

With Forge, you’re in control of how and when data leaves Atlassian cloud. As a FaaS platform Forge takes care of authentication, identity, scaling, and tenancy.

Forge apps run inside a second security layer that enforces tenancy isolation and data egress restriction by design. See our shared responsibility model, for what’s shared between you and Atlassian when building a Forge app."

Carmen Nadeau

Hi @[deleted]

Here are my rigorous criteria to follow when acquiring an app. I made those after using different apps for the first 4-6 years and I have been using Atlassian products (admin) and apps for 14 years now, Keep in mind that depending on the rarety of a functionnalities found in an app, we may not follow those criteria.

Supplier:

Supports apps
Is an Atlassian partner
Has passed the Security Self-Assesment program
Offers several apps in the Marketplace
Has been in business for several years (minimum 5 years)
Has fast, satisfactory support (mentioned in comments from app users)

If the supplier meets these criteria, contact them to obtain a short- and medium-term roadmap (1-3 years).

Apps:

Participate in the Marketplace Security Bug Bounty program
Has been in existence for at least 3 years
Is well rated in the Marketplace by users
Has several versions of the app and is updated regularly (at least once a year)
Validates its versions at the same rate as those of Atlassian
Has more than 500 installations of this app
Offers adequate documentation for both administrator and user

After that it goes through the homologation process, it is really severe so it may not pass muster.

Carmen

All comments

Lucas_DevSamurai_

Hi @[deleted], it's great to see such an interesting question.

Although User reviews plays a big role, I will pay more attention to the most recent reviews rather than the overall positive ones 😉

Stavros_Rougas_EasyApps

@[deleted] built in Forge and supports data residency.

Forge is the new cloud app development platform by Atlassian. We build all our apps in Forge. All data remains within your Confluence instance. By default Forge supports data residency.

About Forge:

"Secure by design

With Forge, you’re in control of how and when data leaves Atlassian cloud. As a FaaS platform Forge takes care of authentication, identity, scaling, and tenancy.

Carmen Nadeau

Hi @[deleted]

Supplier:

Supports apps
Is an Atlassian partner
Has passed the Security Self-Assesment program
Offers several apps in the Marketplace
Has been in business for several years (minimum 5 years)
Has fast, satisfactory support (mentioned in comments from app users)

If the supplier meets these criteria, contact them to obtain a short- and medium-term roadmap (1-3 years).

Apps:

Participate in the Marketplace Security Bug Bounty program
Has been in existence for at least 3 years
Is well rated in the Marketplace by users
Has several versions of the app and is updated regularly (at least once a year)
Validates its versions at the same rate as those of Atlassian
Has more than 500 installations of this app
Offers adequate documentation for both administrator and user

After that it goes through the homologation process, it is really severe so it may not pass muster.

Carmen

Josh_Unito

Hi @Carmen Nadeau ! Just curious - could you share any examples of a partner with adequate documentation? What's your criteria for high quality docs? Thanks!

Carmen Nadeau

Scriptrunner, Refined and Deviniti have good documentation.

It is important to have a good doc for the admin AND the user

Stavros_Rougas_EasyApps

@Carmen Nadeau lots of good points.

I would add cost.

An app with the most installs can have a higher price, but is it value for money? Test at least two, often lots of options in the marketplace, you would be surprised the difference. A new app can have a younger code base which can actually make it better. Use the pricing calculator to see the price before you install.

How many installs is enough for you to have confidence in an app?

That's a tricky one, I get why @Carmen Nadeau says 500, but that number is misleading for cloud. It could be 400 server installs, while as a cloud user you can more about the 100 for cloud. Many of the sever installs could be for many years ago when competitors didn't exist.

Atlassian says at some point the will separate data center versus cloud installs, and at the same time I believe delete the server numbers. An app that is cloud only illogically looks weaker than one with also a server version, especially one that has been in existence for a long time.

Stavros_Rougas_EasyApps

@Carmen Nadeau "If yours [requirements] are less restrictive".

I'm not saying that at all. I'm saying that if you are a cloud user and you are comparing a cloud only app versus one with cloud, server and data center versions then the install numbers can be unequal comparisons.

I don't think a lot of users know that installs are totals, it is like having an iPhone app and the Mac app version for the same app being the same install number, this is not done. I support Atlassian's commitment to changing the number to separate cloud and data center installs. They didn't give a timeline.

unknown

Thanks @Lucas_DevSamurai_ , this is awesome. I really appreciate your input

unknown

Thanks @Stavros_Rougas_EasyApps much appreciated

Ulrich Kuhnhardt _IzymesCo_

Not an answer, just a BIG THANKS to @[deleted]for posting this 'poll' and all the responders! Your contributions are so valuable.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

security

compliance