OVERALL RATINGS
SUPPORT
- Partner Supported
TRUST SIGNALS
Key highlights of the appProve who can see and administer every Jira project, every night. Audit-ready evidence for SOC 2 and ISO 27001 access reviews
Quarterly access reviews, checked every night
Turn SOC 2, ISO 27001 and SOX user access reviews into rules the app checks nightly. You get a dated result for every rule, not a spreadsheet someone fills in once a quarter.
Every violation shows the exact access path
When someone has access they shouldn't, the result names the full path: project, permission scheme, grant, role, group, account. With findings on, one Jira ticket tracks each episode, not one per user.
Nothing passes on partial data
A rule passes only when every group and role behind it was read in full. Anything unreadable is UNKNOWN with a reason. Read-only: it never changes a permission, and no data leaves Atlassian.
Supporting media
More details
Four rule types: who may browse a project, who must not, who may administer it, and which groups issue security may grant to. Rules read as sentences. A new rule can start from a project's current access: the app proposes a baseline and you tick who is meant to have it. Editing a rule publishes its next revision, so its history stays together.
Each result carries its evidence: what was read, the labelled grant path behind every violation and reason codes for anything unknown. Admin rules count Jira administrators. Evidence is kept for 400 days and exports as CSV and JSON.
All data stays in Forge storage in your Atlassian cloud. No external servers, no analytics.
Scope: company-managed projects (service projects too, for staff; portal customers aren’t checked) and team-managed software spaces, up to 25 per rule, on sites with up to 4,000 active accounts (1,250 for admin rules). Other team-managed spaces and issue-security rules on service or team-managed projects are refused.
Resources
App documentation
Comprehensive set of documentation from the partner on how this app works
Privacy and Security
Privacy policy
Atlassian's privacy policy is not applicable to the use of this app. Please refer to the privacy policy provided by this app's partner.
Partner privacy policySecurity program
This app is not part of the Marketplace Bug Bounty program.
Integration permissions
Access Assertions: User Access Review & Permission Audit integrates with your Atlassian app
Version information
Version 3.19.0•for Jira Cloud
- Release date
- Oct 11th 2026
- Summary
- Tickets count people in the rule line
- Details
The rule line in a new findings ticket no longer prints account IDs. Groups are still named, and people are counted instead, as in "Only g1 and 2 named people may browse PAY." A short line says the people are listed in the app. Ticket text stays in Jira after an account is closed, so the app now keeps people out of that line. On a team-managed space's first night, Overview and Diagnostics now say the gap won't clear on its own. They used to say a later run might clear it.
- Payment model
- Paid via Atlassian
- License type
- Commercial