Security
How MailView handles your data
Written for the person who has to approve an app before a service desk may use it. Short, specific, and checkable against the Marketplace listing and the app's declared permissions.
In one paragraph
MailView runs on Atlassian Forge inside your own Atlassian site. It reads email attachments (.eml and .msg) with the user's own permissions, in the user's browser (and, for PDF and Word export in Confluence only, in a short-lived Forge function on Atlassian's platform), and renders them with scripts, forms and remote content removed. It has no servers of its own, no external connections, no storage and no logging of email content. Nothing leaves your site.
What the app is allowed to read
MailView for Jira and Jira Service Management requests one permission: read:jira-work. It reads the attachments of the work item you are looking at, as you. Jira enforces your permissions on every read, so the app can never show you an attachment you could not download yourself. It has no write permission: it cannot change, add or remove anything on the work item.
MailView for Confluence requests read:attachment:confluence. It reads the email attachments of the current page, as you. The one server-side function it has (used for PDF and Word export) also reads the attachment as the current user and does not log email content.
Both apps are built to qualify for Atlassian's Runs on Atlassian badge: no external network calls and no data stored outside the Atlassian platform. Once an app is listed, that badge on the Marketplace listing is the independent confirmation.
Where the email is processed
The attachment is fetched from your Atlassian site into the browser of the person reading it, parsed there, and shown there. There is no Dortus backend in the path. The one exception is the PDF and Word export in MailView for Confluence: a Forge function on Atlassian's own platform reads the attachment as the current user, builds the export, and keeps nothing. Closing the work item or page discards the parsed email; MailView keeps no copy and no cache outside the browser session.
Rendering suspicious email safely
Every email is treated as untrusted. Before anything is shown, the HTML body is sanitized with DOMPurify: scripts, event handlers, iframes, forms, object and embed elements, meta refresh, and javascript:, vbscript: and data: links are removed (a data: address is kept only for images inside the email). Remote images, external stylesheets and tracking pixels are blocked, so rendering an email makes no network requests and does not tell the sender it was opened. Links open in a new tab with rel="noopener noreferrer", and the Details tab shows the address each link points to before anyone clicks (short links and redirects are not followed). Size and nesting limits (10 MB, one level of nested messages) and a 30-second limit on reading a file keep oversized and broken emails in check, but a deliberately crafted email can still freeze the view for a while. These cases are covered by unit tests.
The phishing verdict is an aid for the person triaging the email, not a security control. It checks headers, links and attachments in the browser and can miss things.
The app's source is not public; these statements match the security questionnaire we submitted to Atlassian, and we will answer specific questions from a security review by email.
Dependencies and vulnerabilities
Dependencies are pinned to exact versions in each app's lockfile. Reported vulnerabilities are handled within Atlassian's Marketplace bug fix timelines: critical within 10 days, high within 4 weeks, medium within 12 weeks. Security reports go to support@dortus.com and are answered by the developer.
If something goes wrong
In the event of a security incident affecting the app, Atlassian is notified within 24 hours through their partner process, as their guidelines require. Affected customers are notified within 72 hours; that is our own commitment, not an Atlassian rule.
How to check this yourself
Once the app is listed on the Marketplace:
- The Marketplace listing's Privacy & Security tab contains the questionnaire answers these pages are based on.
- The Runs on Atlassian badge on the listing confirms there is no external egress.
- During installation, Atlassian shows the exact permissions the app requests. If you see anything beyond the permissions named above, do not install and tell us.
Questions
Anything unclear or missing for your review? Email support@dortus.com.