🛡️ EvidenceLog for Jira User Guide
📁 Developer PRD 🔍 Offline Verifier

EvidenceLog for Jira — Production User Guide

Automated change-management compliance ledger for engineering teams, QA leads, and compliance officers undergoing SOC 2 Type II, ISO 27001, HIPAA, and FedRAMP audits.

Publisher: Langtago (langtago.com) Version: 4.2.0 (Enterprise) Platform: Atlassian Forge Cloud Native Data Egress: 0.00% (Strict Zero Egress)

1. Product Overview & Value Proposition

Modern software organizations undergoing SOC 2 Type II, ISO 27001, HIPAA, or FedRAMP audits lose dozens of engineering hours manually compiling spreadsheets, screenshotting Jira tickets, and hunting down pull request URLs. Traditional audit sampling only inspects 25–40 arbitrary pull requests months after code deploys, missing tickets that skipped peer review or bypassed QA.

EvidenceLog for Jira converts your Jira workflow into an **automated, self-verifying compliance ledger**:

⚡
In-Situ Evaluation
Inspects Acceptance Criteria, multi-cloud Git links (GitHub, GitLab, Bitbucket, Azure), changelog transitions, QA sign-offs, and SAST scans continuously.
🛡️
Preventive Gatekeeper
Programmatically blocks developers from resolving or closing tickets until all 5 regulatory change controls are satisfied.
🔐
Cryptographic Immutability
Computes SHA-256 issue fingerprints and binary release Merkle tree roots stored in Atlassian Forge encrypted storage.
🔒
Zero Data Egress
Executes 100% inside the Atlassian Forge Node.js sandbox. No external databases, zero egress, and $0 cloud maintenance.

2. Quickstart Guide: From Zero to Certified Audit Trail

Follow these 4 simple steps to certify an issue in your Jira project:

  1. Open any Jira Issue: Navigate to any development issue. Look for the EvidenceLog Compliance panel in the right sidebar.
  2. Review the Compliance Checklist: The panel shows whether the ticket is AUDIT READY (5/5) or ACTION REQUIRED.
  3. Apply 1-Click Fixes: If any check is missing, click [+ Append AC Template], [+ Apply "qa-verified" Label], or [+ Post QA Sign-off] directly in the panel.
  4. Certify & Save Snapshot: When all 5 checks turn green, click "⚡ Certify & Save Snapshot" to permanently lock the immutable SHA-256 record in Forge encrypted storage.
💡 Pro Tip for Engineering Leads
When an issue is transitioned to Done through the workflow, the Preventive Gatekeeper automatically creates a certified snapshot for you upon passing!

3. The Five Core Compliance Pillars

EvidenceLog inspects 5 compliance pillars required by SOC 2, ISO 27001, HIPAA, and FedRAMP:

Pillar Regulatory Control Verification Criteria Supported Scanners / Sources
1. Acceptance Criteria SOC 2 CC8.1
ISO 27001 A.8.32		 Explicit Given/When/Then scenarios, Definition of Done, or checklist in description or custom fields. ADF Description, Checklist fields, Customfields
2. Code Linkage & CI/CD SOC 2 CC8.1
ISO 27001 A.8.32		 Linked Git pull request, commit, branch, or automated CI/CD pipeline run. GitHub, GitLab, Bitbucket, Azure DevOps
3. Segregation of Duties SOC 2 CC6.8
ISO 27001 A.5.3		 Author/assignee cannot close ticket without independent peer review transition or comment. Changelog transitions, peer comments, JSM CAB
4. QA Verification SOC 2 CC8.1
ISO 27001 A.8.29		 QA workflow state, qa-verified tag, explicit sign-off comment, or test report attachment. QA labels, Test reports (.xml/.json), Jira comments
5. Security Scan (SAST) SOC 2 CC7.1
ISO 27001 A.8.28		 Automated vulnerability scan pass traces or security lead approval. Snyk, SonarQube, Trivy, Dependabot, OWASP ZAP

4. Using the Issue Compliance Panel

The EvidenceLog panel sits inside every Jira issue view, giving engineers immediate visibility into their audit readiness:

Lifecycle Stage Progress Tracker

A 5-step visual progress bar displays the exact progress of the change:

[✔ 1. AC Defined] ──▶ [✔ 2. Code Linked] ──▶ [✔ 3. Peer Reviewed] ──▶ [✔ 4. QA Verified] ──▶ [✔ 5. Certified]

One-Click Interactive Remediation ("Fix It For Me")

If an engineer is missing an audit control, 1-click action buttons appear directly below the failing check:

  • [+ Append AC Template Checklist]: Inserts a BDD checklist into the ticket.
  • [+ Apply "qa-verified" Label]: Instantly tags the ticket with the verified QA label.
  • [+ Post QA Sign-off Comment]: Posts an official QA confirmation timestamped by the user.

7-Tab Audit Export Drawer

Clicking "Export Evidence Snapshot" opens an interactive drawer with 7 export formats:

  1. Markdown Summary: Human-readable executive summary ready to paste into PRs.
  2. Printable Certificate: Formal PDF/print-ready certificate with cryptographic seal.
  3. Vanta Automated Ingestion: Formatted JSON object for continuous Vanta ingestion.
  4. Drata Automated Ingestion: Formatted JSON object for continuous Drata ingestion.
  5. Raw Structured JSON: Complete cryptographic record with timestamps and actor IDs.
  6. Auditor Spreadsheet CSV: Ready-to-copy CSV row matching auditor sample matrices.
  7. Storage Version History: Live inspection of immutable Forge KVS snapshot history.

5. The Preventive Workflow Gatekeeper

The Preventive Gatekeeper (jira:workflowValidator) enforces compliance before deployment by blocking transitions to Done or Closed if any control fails:

⚠️ Transition Block Example
If an engineer tries to drag an issue to Done without acceptance criteria or a linked PR, Jira displays: 
[EvidenceLog Gatekeeper] Transition blocked by SOC 2 change control policy:
- Missing explicit Acceptance Criteria (Given/When/Then or DoD) in issue description
- Missing linked Git development artifact (Pull Request or branch link)
Please resolve all required evidence before closing.

To resolve the block, simply attach the pull request, click the remediation button, and transition again.

6. The Project Audit Hub (Executive Dashboard)

Accessed from the Jira left navigation sidebar ("EvidenceLog Audit Hub"), this central dashboard gives Engineering Leads and Compliance Officers a complete project overview:

  • 5 KPI Scorecards: Overall Readiness (%), Certified Count, Traceability %, SoD %, and QA %.
  • 1-Click ⚡ Batch Certify: Certifies and snapshots all compliant issues across the project in one transaction.
  • Emergency Hotfix Alerts: Automatically surfaces Sev-1 and hotfix tickets requiring post-release CAB review within 48 hours.
  • Release Audit Dossier: Generates consolidated Markdown, CSV matrices, Merkle tree proofs, and formal printable Executive Release Attestations.

7. Auditor & Compliance Officer Workflows

Auditors can sample and filter issues natively in Jira Search using indexed entity properties:

-- 1. All Audit-Ready Tickets in Project:
project = "DEMO" AND status = Done AND issue.property[evidencelog_compliance].isAuditReady = "true"

-- 2. Non-Compliant Tickets (Exception Sample):
project = "DEMO" AND status = Done AND issue.property[evidencelog_compliance].isAuditReady = "false"

-- 3. Emergency Hotfixes Requiring CAB Review:
project = "DEMO" AND issue.property[evidencelog_compliance].riskLevel = "EMERGENCY"

-- 4. Certified Tickets Locked in Forge Storage:
project = "DEMO" AND issue.property[evidencelog_compliance].certified = "true"

8. Zero-Trust Cryptographic Verification

Auditors do not need to trust Jira or Langtago. Every certified issue produces a deterministic SHA-256 fingerprint: 

Fingerprint = SHA-256(Canonical Evidence JSON Payload)

For release batches, EvidenceLog builds a binary Merkle Tree where pairs of hashes are concatenated and hashed up to a single Release Merkle Root: 

Parent Hash = SHA-256(Left Child Hash + Right Child Hash)
🔍 Offline Verification Tool
Auditors can open docs/verifier.html completely offline in their browser to re-compute and mathematically verify hashes with zero network access.

9. Administrator Guide: Policy Configuration & Security

Administrators can configure project compliance policies stored in Forge KVS:

Policy Setting Default Description
requireAcceptanceCriteria true Enforces explicit Given/When/Then or DoD specifications.
requireDevLinks true Enforces linked Git pull requests or commits.
requirePeerReview true Enforces Segregation of Duties (author cannot close ticket).
requireQASignoff true Enforces QA transition, QA tag, or test sign-off.
requireSecurityScan true Enforces automated SAST/DAST scanner traces.
strictSegregationOfDuties false Rejects informal comment approvals; requires formal transition.
requireSASTForHighRisk false Strictly blocks High-Risk changes unless SAST passes.

10. Frequently Asked Questions (FAQ) & Troubleshooting

Q: Does EvidenceLog send any source code or ticket summaries to external servers?

A: No. EvidenceLog is built 100% on Atlassian Forge. It runs in an isolated Node.js sandbox inside Atlassian Cloud. There is zero data egress, zero third-party telemetry, and zero external database storage.

Q: How does EvidenceLog handle emergency hotfixes deployed at 2:00 AM?

A: Under ITIL 4 and SOC 2 CC8.1, emergency fixes can be deployed with expedited authorization. EvidenceLog flags these tickets as Emergency Changes, alerts release managers in the Audit Hub, and tracks them for mandatory retroactive CAB review within 48 hours.

Q: Can external auditors verify records without a Jira account?

A: Yes. Release managers can export the Release Audit Dossier (CSV/Markdown) or formal printable PDF Certificates. External auditors can inspect these offline and verify their cryptographic SHA-256 hashes using the standalone Offline Verifier.