Compliance Scanner — Detection Logic
The scanner reads every page in a Confluence space, strips the HTML to plain text, and checks it against your glossary using deterministic pattern matching — not AI or NLP. Every finding is reproducible and auditor-verifiable.
What It Detects
The scanner produces three types of findings:
1. Deprecated Terms
A term marked as deprecated is found on a Confluence page. The term should no longer be used — it was replaced or retired.
Finding: Deprecated term "Adverse Reaction" found. Replaced by "Adverse Event" per ICH E2A.
2. Unapproved Terms (Draft / In Review)
A term in draft or review status is already being used on pages — but it hasn't been formally approved yet.
Finding: Term "Risk Assessment" is still in draft — not yet approved for use.
3. Synonym Violations (most common)
An approved term has synonyms defined. When the scanner finds a synonym on a page instead of the official term, it flags it for replacement. This is the primary compliance enforcement mechanism.
Finding: "AE" should be replaced with approved term "Adverse Event".
How Scanning Works
MAP_CONCURRENCY = 4 chunks of SCAN_CHUNK = 300 page-IDs in parallel (App.js:779–781) — so 1,200 pages are processed per round. Within each chunk, page-content fetches run sequentially in groups of BATCH = 8 (index.js:698–702). That means concurrent Confluence API calls stay at 4 × 8 = 32 in flight at any moment — well under Confluence's 10 req/s soft rate limit on sustained throughput.
indexOf check skips terms that aren't on the page at all. This eliminates ~99% of comparisons and keeps the scanner fast even with thousands of terms.
Auto-Scan
In addition to manual scans, the app automatically scans every page when it is created or updated. This happens via Forge event triggers — no manual action required. Findings appear on the dashboard in real time.
Why Not AI/NLP?
Regulated industries (pharma, finance, healthcare) require deterministic, reproducible compliance checks. An AI model that produces different results on the same input is not acceptable for GxP or SOX audits. Our scanner uses strict regex matching with word boundaries — the same input always produces the same findings, verifiable by an auditor.
Architecture
The Compliance Glossary Forge app is built on Atlassian Forge — Atlassian's cloud-native app platform. In the current Marketplace release, the manifest has no external:fetch:backend permission and customer terminology data is processed and stored within Forge. Planned AI-assisted curation is not enabled in that release; its data flow and disclosures are release-gated. (Scope note: this marketing site is hosted on Cloudflare Pages and uses self-hosted, cookieless analytics — Umami and GoatCounter on vigilcom.dev — with no third-party trackers; the Forge app itself does not load these.)
Frontend
Forge Custom UI — a React application running inside a sandboxed iframe within Confluence. Custom UI provides full control over the interface, enabling features like bulk selection, inline editing, compliance dashboards, and dark mode that are not possible with the declarative Forge UI Kit.
Backend
Forge Functions — serverless Node.js handlers that process all data operations. Runs on Atlassian's infrastructure (AWS Lambda). No external servers, no third-party APIs.
Storage
Forge Entity Store (KVS) — Atlassian-managed key-value storage with typed entities and indexes. All glossary terms, version history, scan results, and configuration are stored here. Data is scoped to each Confluence installation — isolated between customers.
Events
Forge Triggers — automatic page-created and page-updated event listeners that trigger real-time compliance scanning. Plus a weekly scheduled trigger for GDPR personal data reporting.
Why Custom UI?
Atlassian Forge offers two UI options:
- UI Kit (declarative) — limited to pre-built Atlassian components. Simpler, but lacks the flexibility needed for complex interfaces like compliance dashboards, bulk operations, and multi-column term tables.
- Custom UI (React in iframe) — full React application with complete control over layout and behavior. This is what Compliance Glossary uses. It enables features like the map-reduce compliance scanner with real-time progress, inline term editing, bulk selection, CSV import preview, audit trail export, and dark mode.
The trade-off: Custom UI components don't inherit Confluence's native styling automatically. We've implemented Atlassian's design tokens and color system to match the Confluence look and feel, including full dark mode support.
Data Flow
- User interacts with the React UI inside Confluence
- UI calls backend resolvers via
@forge/bridge(secure IPC, never leaves Atlassian infra) - Resolvers validate permissions (license check → RBAC check → input validation)
- Data is read/written to Forge Entity Store
- For scans: resolver fetches Confluence page content via internal API, scans against term patterns, saves results
- All write operations create an audit trail entry before the entity change (ALCOA+ Complete principle)
Security & Data Model
- Runs on Atlassian: in the current Marketplace release, app code executes on Atlassian infrastructure and the manifest has no external-fetch permission. Planned AI-assisted curation is release-gated and described separately in the security documentation.
- Read-only Confluence access: the scanner reads page content but never modifies it. All write operations are to the app's own storage only.
- Per-installation isolation: each Confluence site has its own storage partition. Customer A cannot access Customer B's data.
- RBAC: configurable term managers. Only designated users can create, edit, approve, or delete terms.
- Four-eyes principle: the user who submits a term for review cannot be the same user who approves it.
- Audit trail: every change records who, what, when, and why — following the ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate).
- GDPR: personal data limited to Atlassian account IDs in the audit trail. Weekly automated personal data reporting. Right to erasure supported.
- Pricing: See the Atlassian Marketplace.