Tamper-Evident Audit Log for Jira

Every change to every Jira ticket — signed, timestamped, and hash-chained into a tamper-evident, independently verifiable audit log.

Install free on the Atlassian Marketplace →  ·  Read the documentation →

What you get​

• Cryptographically signed — every Jira event (issue created, transitioned, edited, commented, attached, linked, watched) is individually signed with ECDSA P-256, the NIST-standard curve used in TLS, SSH, and EU eIDAS qualified electronic signatures.
• RFC 3161 timestamped — each entry receives a timestamp token from an independent Timestamp Authority, never from the Attestsys server clock.
• Hash-chained — every entry contains the SHA-256 hash of the previous entry's signed payload. Modifying any past entry breaks the chain in a way that is mathematically detectable.
• Offline-verifiable — every export bundle ships with a verify.html file that runs entirely in the browser, validating every signature and chain link without contacting Attestsys.

Why it matters​

"We logged it" is not a useful answer when someone asks you to prove what happened. Most audit-log apps stop at displaying history — if the underlying data store is mutable, the log is only as trustworthy as the vendor that holds it.

Think of a flight recorder. Investigators trust a black box for one specific reason: it sits outside the operator's control — the airline can't edit it mid-flight. Ordinary application logs don't have that property: they're created and stored under the same administrative control as the systems being investigated. That's fine for diagnosing what happened; it hits a credibility ceiling the moment someone outside your trust boundary — a customer in a dispute, an auditor, a counterparty — asks "how do I know these weren't edited afterwards?"

The same failure shows up in security incidents: once a workspace or account is compromised, its own history can't vouch for itself — every investigator's first question is "which records could the attacker reach?" Attestsys keeps a signed, hash-chained record of every workflow change outside that blast radius, so "what was actually done" stays answerable even when the system itself is suspect.

Attestsys is the black-box recorder for your Jira workflow: every action is individually signed and hash-chained at the moment it happens, so that anyone — your team, your customer, an external auditor — can verify the record independently, without trusting Atlassian or Attestsys. The combination of per-entry signing, hash chaining, RFC 3161 timestamping, and portable offline verification is unusual on the Atlassian Marketplace.

Automation changes records too. Scripts, Jira automation rules, and AI agents now modify tickets alongside humans — and "personalized logins" stop being a complete answer the day an agent acts on someone's behalf. Attestsys signs every change with the acting identity captured at event time, human or not, so the question "who — or what — changed this?" has a verifiable answer.

Who it is for​

Try the verifier right now​

Hit Verify the sample bundle to watch a real 12-entry signed chain verify in your browser — every signature, hash-chain link, and RFC 3161 timestamp — or drop your own export ZIP in. It runs entirely client-side and shows you exactly what an auditor sees.

Evidence that collects itself​

On paid editions, the evidence workflow runs without anyone touching it:

• Scheduled exports — daily, weekly, or monthly signed bundles, generated automatically on your cadence.
• Delivered to your cloud — connect Google Drive or OneDrive once, and every scheduled bundle lands in your folder. Share that folder with your auditor and it fills itself.
• Continuous verification — the backend re-verifies your entire chain on a schedule, not just when someone clicks. If a deterministic integrity failure is ever detected, a Slack or Microsoft Teams tamper alert tells you immediately — which workspace, what failed, where to look.

Editions​

See the full pricing page for billing details.

Install free on the Atlassian Marketplace →

EU-hosted (Hetzner Cloud, Nuremberg) · GDPR-aligned · RFC 3161 timestamped