Viewtracker is an Atlassian Forge app with a remote backend. It consists of two logically and physically separate parts: a frontend hosted and sandboxed by Atlassian Forge, and the Viewtracker Remote backend, which we operate and make available in both EU and US regions.
Components
-
Forge App Frontend: The app's user interface. The Atlassian Forge Platform delivers it and embeds it in Confluence as a sandboxed iframe. We do not serve it from our infrastructure.
-
Atlassian Forge Platform: Atlassian's hosted app runtime. It delivers the frontend, forwards Confluence events to our backend, provides authentication, and exposes the Confluence APIs our backend uses to read customer data.
-
Load Balancer: The single public entry point to Viewtracker Remote. All inbound traffic terminates here and is forwarded to the application tier.
-
Scaling Containers: The application tier. It processes API requests and incoming Confluence events, calls the Confluence APIs via the Forge Platform where additional data is required, and reads from and writes to the database. The tier scales horizontally with load.
-
Database (Postgres Aurora): Persistent storage for tracked view data and app configuration.
Request and Data Flows
Rendering a report or macro
A user opens a Viewtracker report or macro in Confluence. Confluence embeds the Forge App Frontend as a sandboxed iframe. The frontend first authenticates against the Atlassian Forge Platform and, based on that, requests a Viewtracker token. The frontend secures all subsequent API requests to Viewtracker Remote with this token. Requests reach the load balancer over its public IP and are forwarded to the application tier.
Event tracking
Confluence reports events such as page views to the Atlassian Forge Platform. The Forge Platform forwards these events to Viewtracker Remote, secured by a Forge token. The application tier processes the events and persists them to the database.
Reading Confluence data
When a request requires Confluence content or metadata not held locally, the application tier calls the Confluence APIs through the Atlassian Forge Platform, secured by a Forge token.
Security Model
The frontend has no direct, unauthenticated path to the backend. Every request from the frontend carries a Viewtracker token issued only after successful Forge Platform authentication, so access to Viewtracker Remote is tied to a valid Atlassian identity and app installation.
Server-to-server communication between the Forge Platform and Viewtracker Remote is secured by Forge tokens in both directions — inbound for event delivery, outbound for Confluence API access. Viewtracker therefore does not store long-lived Confluence user credentials.
The only publicly reachable component of Viewtracker Remote is the load balancer. The application tier and the database are not exposed externally.
Data Residency
The Viewtracker Remote environment is deployed independently in the EU and the US. A customer's data is processed and stored entirely within the region assigned to their installation; tenant data is not replicated across regions.
Atlassian Isolated Cloud
Atlassian offers Isolated Cloud, a hosting model in which a customer's Atlassian instance runs separately from the public cloud. Viewtracker's standard remote environment is not part of that isolation — it is a shared, multi-tenant deployment operated by us. Running Viewtracker alongside an Isolated Cloud instance therefore requires a self-hosted deployment of the Viewtracker stack (load balancer, application containers, and database) within the customer's own isolated environment, so that no application data leaves it.
Self-hosting is not available as a self-service option. Customers who require it should contact us so we can scope the deployment, provide the stack, and agree on the operational and update model.