Work / Attestly
Who had access in March, and who said that was correct?
Attestly runs user access reviews inside Jira Cloud and produces the one thing a spreadsheet never does: a record an auditor can check without trusting you, or us.
Built and running Marketplace listing in preparation
The problem
Jira answers who has access today. An auditor asks two different questions, and Jira answers neither:
- Who had access on 31 March, and who confirmed that list was correct?
- What changed since the previous review?
The organisation audit log is an event stream with a 180-day retention window, so the evidence of a first-quarter review has expired before a third-quarter audit goes looking for it. So teams export spreadsheets, email them to project owners, chase replies, and a year later none of it can be shown to have happened.
What the app does
Four steps, each producing a record rather than a status update.
Takes a snapshot
A point-in-time record of who can do what in a project, and how. Each grant carries its provenance: which group, which project role, or a direct assignment. That is the column that explains why removing someone from a group did not actually remove their access.
Makes someone sign
A named reviewer decides every line. Keeping elevated access requires a written reason, and so does escalating. Ordinary access can be retained without one, and those rows say "not required" rather than sitting blank, so a missing reason never looks like an oversight.
Shows what changed
A diff against the previous review: who gained access, who lost it, and whose permissions or path in changed. Someone who left the company appearing under "gained access" is the finding that justifies the whole exercise.
Exports the evidence
A printable report and a JSON pack. Every event is hashed onto the one before it, so altering a single reason breaks every hash after it, checkable on the auditor's own machine, with the app nowhere in sight.
- seq
- 11
- type
- CAMPAIGN_COMPLETED
- at
- 2026-07-08T10:14:00.000Z
- actor
- Dana Whitfield
- prev
- 990cbe03260817f3f712f28f341ee6b7
- hash
- 38c8648c1a7c522dbbd6ad81d9b94d8d
chain verified, 9 entries
One entry out of a pack. Each record stores a hash of its own contents plus the hash of the record before it, which is what makes the chain a chain. Change a single letter of a single reason and every hash after it stops matching, on the auditor's machine, without our software installed, using a standard hash function and a method we publish rather than describe.
What it deliberately cannot do
The limits are the design, not a gap in it.
It cannot change Jira
Read-only scopes, with no write, manage, delete or admin permission of any kind. A revoke is a decision with a reason, and the report hands it to whoever will make the change as a work order. An app that can both certify access and change it can certify away its own mistakes.
Tamper-evident, not immutable
Breaking the chain is detectable; it is not impossible. Anyone who can write to the underlying storage could recompute it. The report says exactly this, in the same paragraph that explains the guarantee, because a claim of immutability would be the easiest sentence to write and the hardest to defend.
Where the data lives
Inside your own Jira site's Forge storage, on Atlassian's infrastructure, in your site's own region. The app declares no external egress at all: no third-party processor, no analytics, and no AI or language model of any kind. Nothing about your access data is sent to a model, ours or anyone else's.
Display names are never stored. They are read from Jira each time a screen renders or a pack is exported, and the pack stamps that moment. The full detail is in the Attestly privacy policy.
Availability
Attestly is built and running in production. The Atlassian Marketplace listing is being prepared, and the app is not published yet, so if you have found this page early, that is exactly where things stand.
Expected pricing is 2 USD per user per month. Write to help@8lax.com to be told when it is published, or to try it on your own site before then. Feedback at this stage changes the product more than it will later.
Once published, it is licensed under the Attestly terms: the standard agreement Atlassian offers on its Marketplace, plus the terms specific to this app.