• Products
  • Documentation
  • Resources

What data is sent and received when pasting a Smart Link?

This is an outline of what happens when you paste a URL and it turns into a Smart Link. It’s a technical explanation, written for anyone who’s concerned about the security implications of Smart Links.

We’ve used a Google Drive link in this example, but this information is true for other products too.

When you paste a link to a Google Drive document on Confluence or Jira, our system can turn it into a Smart Link. This means you’ll see more information about the file, like its title, last updated date, and a preview image.

Learn more about Smart Links

When you paste a link, our system will check if it's a valid Smart Link based on a domain pattern match (in this example, it’ll check for Google.com).

If the domain matches, and if you’re logged in to your Google account, we’ll transform your link into a Smart Link.

What happens if you aren’t logged in?

The system will ask you to connect and log in to your Google account; this is done using the OAuth2 protocol. This process allows you to log in to your Google account, get an authentication token, and store it securely within our system. This token is crucial for retrieving data from Google (more on that in the next section).

Use the same connected account across Atlassian features and products

Once you connect your Google account, you don’t have to repeat the process of logging in and getting an authentication token. You may be asked to allow certain permissions when you need to use the same account in other products and features.

For information on what information we receive after you connect, read our Privacy Policy.

Once you’ve pasted a link and logged in, our system uses your authentication token (see previous section) to access Google’s API and get metadata about the file like the title, preview image, and last updated date. These details are displayed in the Smart Link.

We never store this data on our own servers. Instead, our system retrieves the metadata in real-time using your authentication token. This means you’ll only see details about the Google Drive file if you have permission to do so.

Example

Let’s say you create a file on Google Drive, but you forget to share it with your teammate. You then post a Smart Link to this file in Confluence.

You’ll see the Smart Link as usual, but your teammate will see a “forbidden” label.

If the link you paste isn’t a supported Smart Link (i.e. we don’t recognize the domain), our system skips the authentication process and calls a third-party service called iFramely.

iFramely will take your link, search the web for metadata that's publicly available, and display it in the Smart Link. If the link requires authentication, we won’t be able to retrieve any information and will simply display the link as pasted.

Either way, we don’t submit any user data or client information to any third-party services.

Learn which products are supported by Smart Links

Additional Help