Skip to main content

Changelog

All notable changes to Attestsys Tamper-Evident Audit Log for Jira are documented here. Versions follow semantic versioning.

v2.0.0 — 2026-05-31​

Initial Atlassian Marketplace release

Capture and signing​

  • Every Jira event captured as a signed audit entry — transitions, edits, comments, attachments, links, watcher changes, deletions
  • ECDSA P-256 signing with RFC 6979 deterministic signatures
  • SHA-256 hash chain linking every entry to the previous one
  • RFC 3161 timestamping via a public timestamp authority on the free tier (non-qualified, clearly labelled in every entry)
  • Idempotent ingestion — overlapping Jira webhooks deduplicated automatically

User interface​

  • Issue panel — signed history per ticket with time, author, activity category, and status; trust footprint popup on every entry showing entry ID, signature algorithm, timestamping authority, and source event ID
  • Admin page — chain integrity status, summary cards (last entry, retention, timestamping authority, verified-entry count, monthly export count), recent activity with clickable Jira deep-links
  • Subscription panel — current plan, upgrade-to-unlock checklist, paid-tier comparison disclosure

Evidence export​

  • Download a cryptographically signed ZIP containing every audit-chain entry for the workspace
  • Bundle includes verify.html — a self-contained HTML file that verifies signatures and chain integrity in any browser, with no internet access and no Attestsys account required
  • Verifier surfaces tampered entries by exact position in the chain

Free-tier limits​

  • 30-day retention; entries older than 30 days are removed
  • 10 evidence-bundle exports per workspace per month
  • HTTP 402 response with reset date on quota exceeded — no crypto resources consumed for over-quota requests

Infrastructure​

  • EU-only hosting (Hetzner Cloud, Nuremberg)
  • TLS 1.2+ in transit, AES-256-GCM at rest, AES-256-GCM envelope-encrypted signing keys
  • Per-tenant cryptographic isolation — keys, chains, and exports cannot cross workspace boundaries
  • GDPR Article 17 orphan-key erasure on tenant deletion

Verifying a release​

Each Marketplace release is signed and published from a tagged commit. To verify which version is installed in your workspace, open the Audit Log admin page — the deployed version is shown in the chain status band.