OVERALL RATINGS
INSTALLS
1
SUPPORT
- Partner Supported
TRUST SIGNALS
Key highlights of the appProve who can see and administer every Jira project, every night. Audit-ready evidence for SOC 2 and ISO 27001 access reviews
Quarterly access reviews, checked every night
Turn SOC 2, ISO 27001 and SOX user access reviews into rules the app checks nightly. You get a dated result for every rule, not a spreadsheet someone fills in once a quarter.
Every violation shows the exact access path
When someone has access they shouldn't, the result names the full path: project, permission scheme, grant, role, group, account. With findings on, one Jira ticket tracks each episode, not one per user.
Nothing passes on partial data
A rule passes only when every group and role behind it was read in full. Anything unreadable is UNKNOWN with a reason. Read-only: it never changes a permission, and no data leaves Atlassian.
Supporting media
More details
Four rule types: who may browse a project, who must not, who may administer it, and which groups issue security may grant to. Rules read as sentences, and a new rule can start from a project's current access.
Each result carries its evidence: what was read, the grant path behind every violation and reason codes for anything unknown. Evidence is kept for 400 days and exports as CSV and JSON.
Access reviews: name up to 10 reviewers and a period on a rule. The app opens each review on schedule. Reviewers decide each row and sign, without Jira admin rights. Signed reviews are kept for 400 days.
Data stays in Forge storage in your Atlassian cloud. No external servers, no analytics.
Scope: company-managed projects (service projects for staff; portal customers aren’t checked) and team-managed software spaces, up to 25 per rule, on sites with up to 4,000 active accounts (1,250 for admin rules). Issue-security rules don't cover service or team-managed projects.
Resources
App documentation
Comprehensive set of documentation from the partner on how this app works
Privacy and Security
Privacy policy
Atlassian's privacy policy is not applicable to the use of this app. Please refer to the privacy policy provided by this app's partner.
Partner privacy policySecurity program
This app is not part of the Marketplace Bug Bounty program.
Integration permissions
Access Assertions: User Access Review & Permission Audit integrates with your Atlassian app
Version information
Version 3.20.0•for Jira Cloud
- Release date
- Oct 15th 2026
- Summary
- Run and sign access reviews in Jira
- Details
A rule can now have an access review plan: reviewers, how often, and reminders. The app opens each review on schedule and lists everyone the rule covers and how each person gets access. Reviewers keep, remove or grant a dated exception row by row on the Access reviews page, which doesn't need Jira admin rights, then sign. Signed reviews copy out as CSV, JSON or HTML and are kept for 400 days. With findings on, a ticket lists the removals by row and access path, never by name.
- Payment model
- Paid via Atlassian
- License type
- Commercial