Configuration
The Tamper-Evident Audit Log is configured from the Admin page, accessible from the Jira project sidebar by users with project-admin or site-admin permissions.
Accessing the admin page
The admin page is a Forge project page embedded directly in Jira. It is accessible to:
- Jira site administrators
- Jira project administrators (for the specific project)
Regular Jira users can view the issue panel (signed history) but cannot access the admin page.
Admin page overview
The admin page shows:
- Chain status band —
Audit Chain INTACT · verified [timestamp] · [Verify now] · [Edition] - Summary cards — Last entry time, Retention period, Timestamping tier, Verified entry count, Exports used this month
- Recent activity — The 5 most recent audit entries across the workspace, with clickable links back to the source Jira issues
- Subscription section — Current edition and an Upgrade call-to-action
Retention policy
| Edition | Retention |
|---|---|
| Free | 30 days |
| Standard | 1 year |
| Advanced | Unlimited |
| Enterprise | Custom (typically 7+ years) |
Retention is enforced automatically by a backend scheduler that runs once per hour. Audit entries beyond the retention limit have their original payload bytes deleted; the cryptographic envelope of each entry (ECDSA signature, hash-chain linkage, RFC 3161 timestamp token, signing certificate) remains intact and verifiable. A signed retention-marker entry is appended to the chain on every non-empty purge run, recording the count of entries whose payloads were removed and the cutoff timestamp used.
Hash-chain verification continues to succeed for entries whose payload bytes have been purged — the signed digest (to_sign_digest) is stored alongside the signature, so the ECDSA verification path needs no payload at all. In the issue panel and admin page, purged entries render with a "purged · retention policy" label instead of the original event verb.
Timestamping tier
| Edition | Per-event timestamp (every entry) | Qualified anchor |
|---|---|---|
| Free | Public RFC 3161 TSA — non-qualified, clearly labelled | — |
| Standard | Public RFC 3161 TSA — non-qualified | Daily EU-qualified QTSP checkpoint over the chain head |
| Advanced | Public RFC 3161 TSA — non-qualified | Daily EU-qualified QTSP checkpoint over the chain head |
| Enterprise | Per-event qualified QTSP — tenant-selectable from the EU Trusted List shortlist | Per-event + optional non-modification heartbeat |
Verifying the chain
Click Verify now on the admin page to run a full chain verification on demand. The verification:
- Checks every entry's ECDSA signature against the tenant's signing public key
- Checks every entry's hash chain linkage (
prev_hashmatches SHA-256 of the previous entry's signed payload) - Accumulates all failures — it does not stop at the first broken link
- Reports the total verified count and any failures
The result is shown in the chain status band. A full verification across a large chain may take a few seconds.
Exporting evidence bundles
Click Download Evidence Bundle to generate and download the current signed chain as a ZIP. See Evidence Bundle Export for full details on bundle contents and offline verification.
On the free tier, a maximum of 10 exports are allowed per calendar month. The admin page shows the current count and reset date.
Permissions reference
The app requests the following Jira scopes:
| Scope | Reason |
|---|---|
read:jira-work | Read issue data for the signed history panel |
read:jira-user | Resolve Jira user display names for audit entries |
write:jira-work | (if applicable — confirm from manifest) |
All data processing is governed by the Data Processing Agreement and Privacy Policy.