Tamper-Evident Audit Log for Jira
Every change to every Jira ticket — signed, timestamped, and hash-chained into a tamper-evident, independently verifiable audit log.
What it does
The Tamper-Evident Audit Log for Jira captures all activity on your Jira tickets and converts each event into a cryptographically-signed, hash-chained audit entry. Every comment, status transition, field edit, attachment, link, and watcher change produces a chain entry that is:
- Cryptographically signed with ECDSA P-256 — the NIST-standard curve used in TLS, SSH, and EU eIDAS qualified electronic signatures
- RFC 3161 timestamped by an independent timestamp authority — not the Attestsys server clock
- Hash-chained to the previous entry — so any insertion, deletion, or modification of a past entry breaks the chain in a way that is mathematically detectable
- Offline-verifiable — export a self-contained bundle and verify every signature and chain link in a browser, with no internet connection and no Attestsys account required
Who it is for
| Role | What you get |
|---|---|
| Security engineers and SREs | An unforgeable record of who changed what in Jira, and when — independently verifiable without trusting Atlassian or Attestsys |
| Engineering and DevOps leads | A signed change trail across tickets, linked to deploys and approvals — export and share with anyone who needs to review it |
| Ops and process owners | Proof that your change-management process was followed, captured automatically without manual collection |
| Teams running audits or reviews | Tamper-evident records that eliminate screenshot-and-paste audit preparation |
| Compliance and GRC teams | Signed, un-fakeable change-management evidence for SOC 2 / ISO 27001 — exportable, and on paid editions delivered straight into Drata and Vanta, replacing the manual app-level evidence those tools can't capture |
The four-property stack
Four properties together — most Marketplace audit apps ship one or two of these, but the combination is what makes the evidence independently verifiable:
| Property | What it means |
|---|---|
| Per-entry cryptographic signing | Each audit entry is individually signed — not just the export |
| Hash chaining | Each entry contains the SHA-256 hash of the previous entry's signed payload, creating a chain where any past modification is detectable |
| RFC 3161 trusted timestamping | Every event is timestamped at ingest by an independent public RFC 3161 TSA (e.g. FreeTSA or DigiCert), not by Attestsys — non-qualified, clearly labelled. Paid tiers add a daily EU-qualified checkpoint over the audit chain from an EU Trusted List QTSP; Enterprise adds per-event qualified timestamping with a selectable QTSP |
| Portable offline verification | Every export bundle includes verify.html — a self-contained verifier that runs entirely in the browser with no outbound connections |
Editions
Full cryptographic stack on every tier. ECDSA P-256 signing, hash chain, RFC 3161 timestamping, and the offline
verify.html ship with the free tier — no weakened crypto, no hidden gates. Every event is timestamped instantly on every tier; paid tiers add longer retention, a daily EU-qualified anchor over your audit chain, and operational integrations on top of the same cryptographic foundation.Free
Genuinely free. Full crypto. Forever.
- Retention
- 30 days
- Bundle exports
- 10 / month
- Timestamping
- Public RFC 3161 TSANon-qualified, clearly labelled
- Hash-chain signing (ECDSA P-256)
- RFC 3161 timestamping
- Offline `verify.html` in every bundle
- EU-hosted on certified German infrastructure
Standard
For teams that need a year of history.
- Retention
- 1 year
- Bundle exports
- Unlimited
- Timestamping
- Public RFC 3161 + daily QTSP anchorEU-qualified daily checkpoint
- Everything in Free
- Continuous chain verification + Slack / Teams tamper alerts
- Daily EU-qualified anchor over your audit chain
Recommended
Advanced
Compliance teams shipping evidence to auditors.
- Retention
- Unlimited
- Bundle exports
- Unlimited
- Timestamping
- Public RFC 3161 + daily QTSP anchorEU-qualified daily checkpoint
- Everything in Standard
- Scheduled exports delivered to Google Drive / OneDrive
- GRC webhooks (Drata · Vanta)
- Rovo Companion Agent
Enterprise
Custom contract, custom residency, named support.
- Retention
- Custom
- Bundle exports
- Unlimited
- Timestamping
- Per-event QTSP, selectableChoice of EU Trusted List QTSP
- Everything in Advanced
- Per-event qualified timestamping + jurisdiction choice
- Custom Data Processing Agreement
- Custom data-residency arrangements
- Named-account support contact
Free, Standard, and Advanced are billed per-user through the Atlassian Marketplace at the rates published on the listing. Enterprise is a flat-fee contract with a signed Data Processing Agreement.
Getting started
The Tamper-Evident Audit Log is live on the Atlassian Marketplace and installs in under two minutes — only read-only Jira permissions, no credit card.
- Install from the Marketplace — pick your Jira site (site-admin permission required) and approve the
read:jira-work/read:jira-userscopes. Full walkthrough with screenshots: the install guide. - Open any issue — the Audit Log panel shows that issue's signed history, each event hash-chained and RFC 3161 timestamped the moment it happens.
- Open the project's Audit Log page — see the workspace chain status (INTACT), retention, recent activity, and Download Evidence Bundle.
- Verify it yourself — open
verify.htmlinside the exported ZIP in any browser, or try the offline verifier on a sample bundle right now.
Install free on the Atlassian Marketplace →
Next steps
- Feature Reference — detailed feature documentation
- Cryptographic Verification — how the signing, timestamping, and hash chain work
- Configuration — admin settings, retention policy, permission scopes
- Troubleshooting — common issues and resolutions