Access Auditor for Jira
Who can access what in your Jira Cloud site, and why — resolved down to the people who hold each permission and the chain of configuration that gave it to them.
- Documentation Setup, the eight tabs, the twelve risk rules, every declared scope, the known limits and the error codes.
- Security & privacy statement Hosting, the data processed, personal data, storage, residency, egress, scopes, retention, logging and subprocessors.
- Privacy policy The formal policy covering the app and this site.
- Service level agreement Support hours, first-response times, security fix timelines, and what is not covered.
- Support How to reach Matify, and what to send so the first reply is useful.
What it does
Access Auditor scans your site's permission schemes, project roles, groups, shared filters and shared dashboards, resolves each grant to the people and groups who actually hold it, and reports the configurations most likely to be a risk. It then tracks what changes between scans, so an access review is a comparison rather than a fresh investigation.
Security posture in one paragraph
The app runs entirely on Atlassian Forge: Atlassian hosts both the compute and the storage, inside your own Jira Cloud installation. It declares no ability to send data outside Atlassian and no ability to write anything to Jira, and both of those are enforced by the platform rather than by the app's own discipline. It does store personal data — Atlassian account identifiers and display names — because an access review that cannot name who holds a permission is not an access review. The security and privacy statement sets out exactly what, where, for how long, and how to remove it.