draw.io data security and privacy policy on Confluence Cloud

[Dileepa Prabhakar]

draw.io looks like a pretty cool diagramming tool and I want to give it a try. The linked data security and privacy policy was very clear and reasonable, but it looks like that only applies to the server version and not the cloud version.

For draw.io on Confluence Cloud, 

1. Does the same policy apply?
2. Where are the diagrams stored? On the Confluence server or on the draw.io server?

Lastly, the Confluence Cloud version appears to be free. I'd like to understand upfront if that is really free or is it free with limitations or free with adverts/upsell?

[David Benson _draw_io_ · Accepted solution]

It is very close, but does need a separate document now I look at it.

Diagrams are stored as attachments on the Confluence Cloud instance, we don't persist anything. The diagram data goes direct between the client and Confluence on save/load, it doesn't pass through our servers.

We have an FAQ entry on this.

Edit 2018.05.07 : draw.io for Confluence Cloud changed to being pay for in August 2017.

[Dileepa Prabhakar]

Thanks for the quick response and the clarification, David. That answers my questions.

Interesting point about migration to the Server version. Would you mind sharing some additional context around that?

[David Benson _draw_io_]

What information were you looking for, specifically?

[Dileepa Prabhakar]

I would have thought that the cloud versions scale better (isn't that one of the promises of cloud?). That's still likely true, so I am guessing that there are other reasons why companies choose to migrate to Server once they hit a certain usage size (which probably varies from company to company). I was looking for a bit more context around that statement, just out of curiosity.

[David Benson _draw_io_]

(Purely my personal opinions and observations) I think there's 4 main issues I've seen.

1. Privacy and data control. When companies get to a certain size they tend to have IT teams large enough to run server and the board tend to sleep better thinking the data is all safe behind their firewall (which is unlikely). In Germany, for example, a number of laws relating to data transit meaning there's a very heavy lean towards Server.
2. Lack of plugin support. This is improving, but there's a notable lack of theming support, though I know Atlassian are looking at addressing that.
3. Control of upgrades. With Cloud you get the latest whether you like it or not. It can be easier to bunch together some new features and control when you need to train users on the changes.
4. The lack of addressing https://jira.atlassian.com/browse/CLOUD-6999. https is pretty much the standard now. For an internal Confluence the lack of a custom domain might not be such an issue. But even us, with our 10 users Confluence at https://support.draw.io, switched from Cloud to Server because an atlassian.net URL doesn't look professional enough. The workaround is to get an expert to host it for you, but using Server (e.g. https://swift.seibert-media.net/)

I think Cloud will get there on most points and these aren't a burning issues for many users now. But, for now, we see 1 going Server->Cloud for every 10 going the other way. That's just from the perspective of a plugin vendor, Atlassian will have more accurate figures.

All said, you have to suspect most things will go cloud in 10, 20, 30 years, just a question of when.

[Dileepa Prabhakar]

Thank you for the insight. I've heard complaints about #2 from other groups where I work and I hope the Atlassian addresses that soon. Tied to #1, license consolidation (cost savings) across cloud instances by different groups within a company may be another reason to go to the server version, tied to #1.