Detent PointVersion: 1.0 · Published: 30 October 2026 · Publisher: Detent Point LLC, Washington, USA
Structure follows GDPR Art. 28(3). The EU Standard Contractual Clauses (2021/914, Module 2, controller-to-processor) and the UK International Data Transfer Addendum are incorporated by reference and attached as Annexes when a customer signs.
Parties. "Customer": the organisation that owns the Atlassian Confluence Cloud site on which WikiMint is installed. "Processor": Detent Point LLC, a Washington limited liability company ("Detent Point").
Effective: on the Customer’s installation of WikiMint, or on signature if signed.
1. Scope and roles
1.1 This DPA governs Detent Point’s processing of Personal Data contained in Customer Content — source code the Customer’s users submit through the WikiMint macro, and documentation generated from it — on the Customer’s behalf. For Customer Content, Customer is controller (or processor on behalf of its own controllers) and Detent Point is processor.
1.2 Site identifiers, installation identifiers, licence state and per-request metadata are processed by Detent Point as an independent controller for service operation, security and billing, as described in the Privacy Policy, and are outside this DPA.
1.3 In case of conflict, this DPA prevails over the end-user licence terms shown in the Marketplace listing (the Standard Atlassian EULA, or Detent Point’s own End User Terms if later adopted) as to Personal Data.
2. Details of processing (Art. 28(3) / SCC Annex I.B)
| Item | Description |
|---|---|
| Subject matter | Generation of documentation from Customer-submitted source code via the WikiMint Confluence app |
| Duration | Term of the Customer’s WikiMint subscription or free-band use, plus deletion period in §9 |
| Nature and purpose | Automated parsing and rendering of submitted code into documentation, returned to the Customer’s Confluence site |
| Type of Personal Data | Any Personal Data the Customer chooses to include in submitted source code (typically none; incidentally names, e-mail addresses, identifiers in comments or strings) |
| Categories of data subjects | Customer’s employees, contractors and other persons referenced in submitted code |
| Frequency | Continuous, at the Customer’s initiative per request |
| Retention | See §9 and Privacy Policy §6 |
3. Processor obligations
Detent Point shall:
(a) process Customer Content only on Customer’s documented instructions — which are: the use of the WikiMint macro by Customer’s users — unless required by law, in which case Detent Point informs Customer before processing where legally permitted;
(b) ensure persons authorised to process Customer Content are bound by confidentiality;
(c) implement the technical and organisational measures in Annex II;
(d) not engage a sub-processor without meeting §5;
(e) taking into account the nature of processing, assist Customer with data-subject requests (§7);
(f) assist Customer with Art. 32–36 obligations (security, breach notification, DPIAs) insofar as the information is available to Detent Point;
(g) delete or return Customer Content at end of service per §9;
(h) make available information necessary to demonstrate compliance and allow audits per §8;
(i) immediately inform Customer if, in its opinion, an instruction infringes data-protection law.
4. Customer obligations
Customer is responsible for the lawfulness of the Personal Data it submits, for its users not submitting secrets or Personal Data they are not entitled to share, and for any DPIA its own processing requires.
5. Sub-processors
5.1 Customer gives general authorisation to the sub-processors in Annex III (currently: Atlassian Pty Ltd — Forge runtime and app storage; Microsoft Corporation — Azure Container Apps hosting and Azure Monitor logging, US East). No other sub-processor receives Customer Content; no AI or model provider is used.
5.2 Detent Point gives at least 30 days’ notice of any new sub-processor that will process Customer Content (by notice to the installing administrator and update of the Privacy Policy). Customer may object on reasonable data-protection grounds within that period; if unresolved, Customer may terminate the affected service.
5.3 Detent Point imposes data-protection obligations on sub-processors no less protective than this DPA and remains liable for their performance.
6. Security
Detent Point implements the measures in Annex II: TLS in transit; encrypted secrets; least-privilege access; no logging or persistence of submitted code (held in memory and a temporary file deleted after parsing); 1 MB request limit; tenant isolation in Forge storage; structured logs without Personal Data.
7. Data-subject requests
Detent Point does not respond directly to data subjects concerning Customer Content; it notifies Customer of any such request within 5 business days and provides reasonable assistance. Detent Point holds no index of Personal Data within Customer Content and may be unable to locate specific data; Customer Content is retained only as described in §9.
8. Audit
Detent Point provides, on request no more than once per year, written responses to reasonable security questionnaires and the Atlassian Marketplace Privacy & Security tab responses. On-site audits only where required by a supervisory authority or following a confirmed breach, at reasonable notice and Customer’s cost.
9. Return and deletion
Submitted code: not retained beyond the request (memory and a temporary file deleted when parsing finishes). Generated documentation in Forge app storage: deleted by Atlassian on uninstall per Forge retention terms; Confluence pages written by the app are Customer Content under Customer’s control. Request metadata (controller data, §1.2) is retained per the Privacy Policy.
10. Personal Data breach
Detent Point notifies Customer’s installing administrator without undue delay, and in any case within 72 hours of confirming a breach affecting Customer Content, with the information available at that time, and updates as it becomes available.
11. International transfers
Customer Content is processed in the United States. For transfers of EEA Personal Data, the parties enter into the EU SCCs (Decision 2021/914) Module Two, with: Clause 7 (docking) included; Clause 9 Option 2 (general authorisation, 30 days); Clause 11 optional language not included; Clause 13 / 17 / 18: governing law and forum of the EU member state of the Customer (default: Ireland); Annexes I–III as set out in this DPA. For UK Personal Data, the UK International Data Transfer Addendum (Part 1 tables completed from this DPA) applies. For Swiss data, the SCCs apply with the FDPIC adaptations.
12. Liability and term
Liability is governed by the End User Terms §7, save that nothing limits a party’s liability where prohibited by the SCCs. This DPA lasts as long as Detent Point processes Customer Content.
Annex I — Parties and processing details: as §1–§2.
Annex II — Technical and organisational measures
Transport encryption (TLS); encrypted environment secrets; server-side credential never exposed to browsers; tenant-scoped Forge storage; output escaping before write to Confluence; per-site rate limiting; structured logging designed to exclude Personal Data; vulnerability handling per Atlassian’s Security Bug Fix Policy; security contact Support@detentpoint.com. Hosting: Microsoft Azure Container Apps (US East), single pinned replica, TLS 1.2+ terminated at Azure ingress, secrets held as container-app secrets, deployment via private Azure Container Registry, operator access via Azure RBAC under Detent Point’s Azure tenant; no AI or model provider in the processing chain.