Configuration
The Tamper-Evident Audit Log is configured from the Admin page, accessible from the Jira project sidebar by users with project-admin or site-admin permissions.
Accessing the admin page
📸 Screenshot placeholder — add after Marketplace listing is live. Screenshot: Jira project sidebar showing the Attestsys admin page entry point.
The admin page is a Forge project page embedded directly in Jira. It is accessible to:
- Jira site administrators
- Jira project administrators (for the specific project)
Regular Jira users can view the issue panel (signed history) but cannot access the admin page.
Admin page overview
The admin page shows:
- Chain status band —
Audit Chain INTACT · verified [timestamp] · [Verify now] · [Edition] - Summary cards — Last entry time, Retention period, Timestamping tier, Verified entry count, Exports used this month
- Recent activity — The 5 most recent audit entries across the workspace, with clickable links back to the source Jira issues
- Subscription section — Current edition and an Upgrade call-to-action
Retention policy
| Edition | Retention |
|---|---|
| Free | 30 days |
| Standard | 1 year |
| Advanced | Unlimited |
| Enterprise | Custom (typically 7+ years) |
Retention is enforced automatically. Entries beyond the retention limit are replaced with signed redaction markers — the chain continues to verify and the redaction is itself recorded as a chain entry.
⚠️ MANUAL REVIEW REQUIRED — The exact retention enforcement schedule (daily purge job timing, timezone alignment) should be confirmed against the backend implementation before publishing this page.
Timestamping tier
| Edition | Timestamping |
|---|---|
| Free | FreeTSA (non-qualified RFC 3161, clearly labelled) |
| Standard | FreeTSA by default; QTSP-backed qualified timestamps available as optional upgrade |
| Advanced | QTSP-backed qualified timestamps mandatory (QuoVadis Trustlink B.V. NL primary, GlobalSign nv-sa secondary) |
| Enterprise | QTSP-backed qualified timestamps; tenant-selectable QTSP from EU Trusted List shortlist |
Verifying the chain
Click Verify now on the admin page to run a full chain verification on demand. The verification:
- Checks every entry's ECDSA signature against the tenant's signing public key
- Checks every entry's hash chain linkage (
prev_hashmatches SHA-256 of the previous entry's signed payload) - Accumulates all failures — it does not stop at the first broken link
- Reports the total verified count and any failures
The result is shown in the chain status band. A full verification across a large chain may take a few seconds.
Exporting evidence bundles
Click Download Evidence Bundle to generate and download the current signed chain as a ZIP. See Evidence Bundle Export for full details on bundle contents and offline verification.
On the free tier, a maximum of 10 exports are allowed per calendar month. The admin page shows the current count and reset date.
Permissions reference
⚠️ MANUAL REVIEW REQUIRED — The exact Forge permission scopes required by the app should be confirmed from the Forge manifest (
manifest.yml) before publishing this section. The list below is based on the current scope of implemented features.
The app requests the following Jira scopes:
| Scope | Reason |
|---|---|
read:jira-work | Read issue data for the signed history panel |
read:jira-user | Resolve Jira user display names for audit entries |
write:jira-work | (if applicable — confirm from manifest) |
All data processing is governed by the Data Processing Agreement and Privacy Policy.