Document Vault - Secure Attachments in Jira

Files are held in a locked-down Storage Space, invisible to anyone without Document Vault access, even on work items they can open.

Full access granted only to nominated Jira groups and space roles, re-checked on the server for every request.

A separate tier that can view and download documents but not add, change or delete them. Supports segregation of duties.

Confidential commentary under the same access rules, kept out of the work item's ordinary comment stream.

Allow-list or block-list uploadable file extensions, keeping executables and unapproved formats out of the vault.

Require Document Vault to be switched on space by space, so it is available only where deliberately enabled.

Set access groups, roles and other settings globally, then override them for individual spaces where needed.

Notify full-access users, read-only users and/or the work item assignee whenever a document is added.

Programmatic read and upload of vault attachments, including large files, under the same permission checks as the UI.

Replace the default message shown to users without access, so the presence of controlled documents discloses nothing.

Document Vault records are removed when their work item is deleted, leaving no orphaned files in the storage space.

Import Document Vault data from Jira Data Center during a cloud migration, with pause, resume and progress reporting.

Records every download, update and delete: who, when, and whether it was allowed or denied. Enable globally or per space.

Export one to six months of access history as an auditor-ready CSV, scoped globally or to a single space.

Every update keeps the file it replaced, with the comment made at the time. Restore any earlier version. Keep 1-5 or unlimited.

Restrict a single document to named Jira groups, tighter than the space-wide access rules. Enforces need-to-know.

Require a documented reason for every change, stored against the version and carried into the access log.

Deleted documents and versions are kept for 60 days and can be restored, rather than destroyed on deletion.

Assign a lifecycle state to each document, such as Draft or Approved. Colour-coded, renameable, can be mandatory.

Classify each document by sensitivity or type. Colour-coded, renameable, can be mandatory, set globally or per space.

Files are held in a locked-down Storage Space, invisible to anyone without Document Vault access, even on work items they can open.

Full access granted only to nominated Jira groups and space roles, re-checked on the server for every request.

A separate tier that can view and download documents but not add, change or delete them. Supports segregation of duties.

Confidential commentary under the same access rules, kept out of the work item's ordinary comment stream.

Allow-list or block-list uploadable file extensions, keeping executables and unapproved formats out of the vault.

Require Document Vault to be switched on space by space, so it is available only where deliberately enabled.

Set access groups, roles and other settings globally, then override them for individual spaces where needed.

Notify full-access users, read-only users and/or the work item assignee whenever a document is added.

Programmatic read and upload of vault attachments, including large files, under the same permission checks as the UI.

Replace the default message shown to users without access, so the presence of controlled documents discloses nothing.

Document Vault records are removed when their work item is deleted, leaving no orphaned files in the storage space.

Import Document Vault data from Jira Data Center during a cloud migration, with pause, resume and progress reporting.