Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

What makes an App feel safe?

Stu Lees ____ REVYZ May 23, 2024

I'd love to know your thoughts on which of the following security and trust signals you would personally look for when deciding to install a Marketplace App?

 

1 - Cloud Fortified Status

2 - Positive User Reviews

3 - Atlassian Marketplace Level (Silver, Gold Platinum)

4 - Other trust indicators (please comment)

 

4 answers

3 accepted

Suggest an answer

Log in or Sign up to answer
4 votes
Answer accepted
Lucas_DevSamurai_
Marketplace Partner
Marketplace Partners provide apps and integrations available on the Atlassian Marketplace that extend the power of Atlassian products.
May 23, 2024

Hi @Stu Lees ____ REVYZ, it's great to see such an interesting question.

Like you mentioned, the first thing I will look for is the Cloud fortified status of a specific app. This proves that I can rely on the vendor who made the app to keep my data secured. And besides, it also relates to other trust indicators like SOC 2 or Penetration Test results. I personally believe these indicators can greatly affect my decision when installing an app.

Although User reviews plays a big role, I will pay more attention to the most recent reviews rather than the overall positive ones 😉

Stu Lees ____ REVYZ May 26, 2024

Thanks @Lucas_DevSamurai_ , this is awesome. I really appreciate your input

Like Lucas_DevSamurai_ likes this
3 votes
Answer accepted
Carmen Nadeau
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
May 24, 2024

Hi @Stu Lees ____ REVYZ 

Here are my rigorous criteria to follow when acquiring an app. I made those after using different apps for the first 4-6 years and I have been using Atlassian products (admin) and apps for 14 years now, Keep in mind that depending on the rarety of a functionnalities found in an app, we may not follow those criteria.

Supplier:

  • Supports apps
  • Is an Atlassian partner
  • Has passed the Security Self-Assesment program
  • Offers several apps in the Marketplace
  • Has been in business for several years (minimum 5 years)
  • Has fast, satisfactory support (mentioned in comments from app users)


If the supplier meets these criteria, contact them to obtain a short- and medium-term roadmap (1-3 years).

Apps:

  • Participate in the Marketplace Security Bug Bounty program
  • Has been in existence for at least 3 years
  • Is well rated in the Marketplace by users
  • Has several versions of the app and is updated regularly (at least once a year)
  • Validates its versions at the same rate as those of Atlassian
  • Has more than 500 installations of this app
  • Offers adequate documentation for both administrator and user

After that it goes through the homologation process, it is really severe so it may not pass muster.

Carmen

Josh_Unito
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
May 24, 2024

Hi @Carmen Nadeau ! Just curious - could you share any examples of a partner with adequate documentation? What's your criteria for high quality docs? Thanks!

Carmen Nadeau
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
May 24, 2024

Scriptrunner, Refined and Deviniti have good documentation.

It is important to have a good doc for the admin AND the user

Like # people like this
Stavros_Rougas_EasyApps
Marketplace Partner
Marketplace Partners provide apps and integrations available on the Atlassian Marketplace that extend the power of Atlassian products.
May 24, 2024

@Carmen Nadeau lots of good points.

I would add cost.

An app with the most installs can have a higher price, but is it value for money? Test at least two, often lots of options in the marketplace, you would be surprised the difference. A new app can have a younger code base which can actually make it better. Use the pricing calculator to see the price before you install.

How many installs is enough for you to have confidence in an app?

That's a tricky one, I get why @Carmen Nadeau says 500, but that number is misleading for cloud. It could be 400 server installs, while as a cloud user you can more about the 100 for cloud. Many of the sever installs could be for many years ago when competitors didn't exist.

Atlassian says at some point the will separate data center versus cloud installs, and at the same time I believe delete the server numbers. An app that is cloud only illogically looks weaker than one with also a server version, especially one that has been in existence for a long time.

Like # people like this
Carmen Nadeau
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
May 24, 2024

@Stavros_Rougas_EasyApps 

Of course cost is important, but for us the fonctionnalities will be the important factor between the 2 apps, because they are NEVER identicals.

As for the number of installs vs an older app, for us, being an older app means that the supplier believe in the app and it is a more mature app, with less bugs and probably more fonctionnalities.

When the cie you work for is a financial cie, those criteria are important (we are very much risks averse).

Of course every business has their own criteria, those are ours. If yours are less restrictive, more power to you !

 

Carmen

Like Stu Lees ____ REVYZ likes this
Stu Lees ____ REVYZ May 26, 2024

Wow @Carmen Nadeau  that is an awesome list and I really appreciate it.  As an app developer, it helps us a lot as we can use it as a bench more for what we prioritize off in terms of the things that we can be working on. 


0 votes
Answer accepted
Stavros_Rougas_EasyApps
Marketplace Partner
Marketplace Partners provide apps and integrations available on the Atlassian Marketplace that extend the power of Atlassian products.
May 24, 2024

@Stu Lees ____ REVYZ built in Forge and supports data residency.

Forge is the new cloud app development platform by Atlassian. We build all our apps in Forge. All data remains within your Confluence instance. By default Forge supports data residency.

About Forge:

"Secure by design

With Forge, you’re in control of how and when data leaves Atlassian cloud. As a FaaS platform Forge takes care of authentication, identity, scaling, and tenancy.

Forge apps run inside a second security layer that enforces tenancy isolation and data egress restriction by design. See our shared responsibility model, for what’s shared between you and Atlassian when building a Forge app."

Stavros_Rougas_EasyApps
Marketplace Partner
Marketplace Partners provide apps and integrations available on the Atlassian Marketplace that extend the power of Atlassian products.
May 24, 2024

@Carmen Nadeau "If yours [requirements] are less restrictive".

I'm not saying that at all. I'm saying that if you are a cloud user and you are comparing a cloud only app versus one with cloud, server and data center versions  then the install numbers can be unequal comparisons.

I don't think a lot of users know that installs are totals, it is like having an iPhone app and the Mac app version for the same app being the same install number, this is not done. I support Atlassian's commitment to changing the number to separate cloud and data center installs. They didn't give a timeline.

Stu Lees ____ REVYZ May 26, 2024

Thanks @Stavros_Rougas_EasyApps much appreciated

Like Stavros_Rougas_EasyApps likes this
0 votes
Ulrich Kuhnhardt _IzymesCo_
Marketplace Partner
Marketplace Partners provide apps and integrations available on the Atlassian Marketplace that extend the power of Atlassian products.
May 26, 2024

Not an answer, just a BIG THANKS to @Stu Lees ____ REVYZ for posting this 'poll' and all the responders! Your contributions are so valuable.

TAGS
AUG Leaders

Atlassian Community Events