Zero Data Egress. Built 100% Natively on Atlassian Forge.
Traditional compliance plugins send your Jira tickets and developer activity to external cloud servers. EvidenceLog eliminates this third-party attack surface entirely by executing strictly inside your own Atlassian Cloud boundary.
Architectural Threat Model Comparison
External Multi-Tenant SaaS
- ✕Transmits tickets, issue keys, summaries, and user emails to vendor AWS/GCP servers
- ✕Creates a secondary database holding your sensitive proprietary SDLC records
- ✕Requires 40+ page vendor security questionnaires and extensive SOC 2 subservice auditor review
- ✕Vulnerable to vendor server downtime, DNS outages, or upstream database leaks
100% In-Tenant Atlassian Forge
- 0.00% Network Data Egress. Compute executes purely within Atlassian microVMs
- All snapshot records stored directly in your tenant's encrypted Atlassian KVS storage
- Zero new external vendors added to your security perimeter or vendor risk assessment
- Inherits 99.9% Atlassian Cloud SLA and geographic data residency boundaries automatically
Six Architectural Guarantees for Security & Compliance Officers
Engineered from day one for zero-trust enterprise compliance requirements.
Zero External Servers & Zero Network Egress
EvidenceLog operates zero external EC2/GCP instances, zero foreign API gateways, and zero analytics telemetry brokers. All execution runs strictly within Atlassian's secure microVM sandboxes.
- Zero outbound network requests (no fetch/axios to third-party endpoints)
- Jira ticket summaries and developer identities never leave your tenant
- Immune to third-party SaaS infrastructure breaches or vendor downtime
Encrypted In-Tenant Atlassian KVS Storage
All compliance snapshots, fingerprints, and audit histories are persisted exclusively in your Atlassian Cloud instance via Atlassian Key-Value Storage (@forge/kvs).
- Encrypted at rest using AES-256 managed by Atlassian Cloud HSMs
- Encrypted in transit with TLS 1.3 across internal Atlassian VPCs
- Multi-version immutable history retained up to 10 audited snapshots
Cryptographic SHA-256 & Binary Merkle Proofs
Every certified issue produces an immutable canonical SHA-256 hash. Sprint releases are hashed hierarchically into a single deterministic Binary Merkle Tree root.
- Deterministic JSON canonicalization prevents formatting spoofing
- Detects retroactive ticket tampering, description edits, or link removals
- Auditors can verify release integrity offline without trusting Langtago or Jira
Automatic Data Residency Inheritance
Because EvidenceLog executes inside Atlassian Forge, your compliance data automatically inherits your Atlassian Cloud organization's pinned data residency region.
- Full compliance with United States, European Union, Australia, Germany, and Singapore residency
- GDPR Article 28 data localization and sovereignty requirements fully satisfied
- Zero cross-border transfers or overseas data staging
Zero Third-Party AI / LLM Training Ingestion
Your proprietary code, commit messages, architectural acceptance criteria, and engineer names are never fed into external Large Language Models.
- Zero data transmission to OpenAI, Anthropic, Google Gemini, or AWS Bedrock
- Deterministic, rule-based verification engine runs in pure JavaScript
- Guarantees your intellectual property remains private and protected
Least Privilege Atlassian Forge Scopes
EvidenceLog declares only the minimum necessary Atlassian Forge permission scopes required to inspect change artifacts and update certified issue properties.
- Scopes: read:jira-work, write:jira-work, read:jira-user, read:issue-details:jira, storage:app
- Zero administrative project manipulation permissions
- Auditable via standard Atlassian Cloud Connected Apps administration
Independent Verification Without Trusting Us or Jira
EvidenceLog is designed so that external Big 4 and SOC 2 Type II audit teams do not have to take our word for it. Every certified snapshot produces an idempotent canonical SHA-256 fingerprint. Auditors can open our dependency-free HTML/JS verifier completely offline (air-gapped) on their own laptops to re-compute hashes and verify Merkle root consistency directly against raw Jira JSON exports.
Vendor Security Questionnaire Fast-Track
Q: Where is our customer data stored?
Inside your existing Atlassian Cloud instance. EvidenceLog uses the Atlassian Forge Key-Value Storage API (@forge/kvs). Langtago maintains no foreign databases, caches, or AWS buckets containing your Jira data.
Q: Does installing EvidenceLog require a new Business Associate Agreement (BAA) or Data Processing Agreement (DPA)?
Because EvidenceLog runs within Atlassian Forge and executes zero outbound data egress, your data processing is governed by your existing Atlassian Cloud Master Subscription Agreement and DPA. Langtago does not receive, transmit, or store personal or healthcare data outside your Atlassian boundary.
Q: How is access controlled within Jira?
EvidenceLog adheres to native Jira Cloud permission schemes. Only authorized project members can view issue panels or the Project Audit Hub. Administrative policy configurations (such as custom QA labels or strict SoD enforcement) are restricted to designated Jira Project Administrators.